@vzn/vx 0.0.595 → 0.0.596

package/src/graph/task-graph.ts

@@ -1,4 +1,3 @@
-import path from 'node:path'
 import type { ProjectConfig, TaskConfig, WorkspaceRules } from '../config.js'
 import {
   asTrees,
@@ -109,6 +108,11 @@ export function isGroupTask(node: TaskNode): boolean {
   return node.config.exec === undefined
 }
 
+/** The default `build` (orchestrator/projects.ts): a config cannot key a group, so it is the one keyed group. */
+function isKeyedGroup(task: TaskConfig): boolean {
+  return task.exec === undefined && task.cache !== undefined
+}
+
 /**
  * Mark, for focused-flow display, the real tasks a requested GROUP
  * stands for. A group has no output of its own, so `vx run build`
@@ -160,7 +164,8 @@ export function markSurfacedDeps(nodes: Map<string, TaskNode>): number {
  *
  *   - Bare task names (`'build'`) → one entry per project in
  *     `candidates` that declares the task. Missing in a given project
- *     is silent (sparse tasks are normal across a workspace).
+ *     is silent (sparse tasks are normal across a workspace). A task
+ *     `unselected` holds (the default `build`) is no match.
  *   - Anchored entries (`'pkg#task'`) → one entry exactly, ignoring
  *     `candidates`. Silently dropped if pkg/task doesn't exist (the
  *     CLI's pre-validation catches malformed strings).
@@ -171,6 +176,7 @@ export function expandRequested(
   tasks: readonly string[],
   candidates: readonly string[],
   projects: Map<string, ProjectEntry>,
+  unselected?: (task: TaskConfig) => boolean,
 ): Array<{ project: string; task: string }> {
   const seen = new Set<string>()
   const out: Array<{ project: string; task: string }> = []
@@ -189,7 +195,7 @@ export function expandRequested(
       continue
     }
     for (const name of candidates) {
-      if (declaresTask(projects, name, spec)) push(name, spec)
+      if (selectsTask(projects, name, spec, unselected)) push(name, spec)
     }
   }
   return out
@@ -214,6 +220,17 @@ function declaresTask(projects: Map<string, ProjectEntry>, project: string, task
   return declaredTask(projects.get(project)?.config, task) !== undefined
 }
 
+/** What a bare name matches: a declared task `unselected` leaves alone. */
+function selectsTask(
+  projects: Map<string, ProjectEntry>,
+  project: string,
+  task: string,
+  unselected: ((task: TaskConfig) => boolean) | undefined,
+): boolean {
+  const config = declaredTask(projects.get(project)?.config, task)
+  return config !== undefined && unselected?.(config) !== true
+}
+
 /**
  * The requested specs `expandRequested` silently dropped — each one
  * matched NO project, so nothing it asked for will run.
@@ -230,6 +247,7 @@ export function unresolvedRequests(
   tasks: readonly string[],
   candidates: readonly string[],
   projects: Map<string, ProjectEntry>,
+  unselected?: (task: TaskConfig) => boolean,
 ): string[] {
   const out: string[] = []
   const seen = new Set<string>()
@@ -239,7 +257,8 @@ export function unresolvedRequests(
     const resolved =
       idx >= 0
         ? declaresTask(projects, spec.slice(0, idx), spec.slice(idx + 1))
-        : candidates.length === 0 || candidates.some((name) => declaresTask(projects, name, spec))
+        : candidates.length === 0 ||
+          candidates.some((name) => selectsTask(projects, name, spec, unselected))
     if (resolved) continue
     seen.add(spec)
     out.push(spec)
@@ -380,6 +399,55 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
     return declared.has(name)
   }
 
+  // Package cycles, for the default `build` (`isKeyedGroup`): each project
+  // on one maps to its strongly connected component, found on the first ask
+  // (iterative Tarjan over `directDeps`, the order the `^name` walk reads).
+  const component = new Map<string, number>()
+  const cyclic = new Set<number>()
+  let components = 0
+  function componentOf(start: string): number {
+    const known = component.get(start)
+    if (known !== undefined) return known
+    const index = new Map<string, number>()
+    const low = new Map<string, number>()
+    const open: string[] = []
+    const work: Array<[name: string, next: number]> = []
+    const enter = (name: string): void => {
+      index.set(name, index.size)
+      low.set(name, index.size - 1)
+      open.push(name)
+      work.push([name, 0])
+    }
+    enter(start)
+    while (work.length > 0) {
+      const top = work[work.length - 1]!
+      const deps = packageGraph.directDeps(top[0])
+      if (top[1] < deps.length) {
+        const dep = deps[top[1]++]!
+        if (component.has(dep)) continue
+        if (!index.has(dep)) enter(dep)
+        else low.set(top[0], Math.min(low.get(top[0])!, index.get(dep)!))
+        continue
+      }
+      work.pop()
+      const name = top[0]
+      const parent = work[work.length - 1]
+      if (parent !== undefined) low.set(parent[0], Math.min(low.get(parent[0])!, low.get(name)!))
+      if (low.get(name) !== index.get(name)) continue
+      const id = components++
+      let size = 0
+      for (let member = ''; member !== name; size++) {
+        member = open.pop()!
+        component.set(member, id)
+      }
+      if (size > 1) cyclic.add(id)
+    }
+    return component.get(start)!
+  }
+  const onCycle = (name: string): boolean => cyclic.has(componentOf(name))
+  const sameCycle = (a: string, b: string): boolean =>
+    onCycle(a) && componentOf(a) === componentOf(b)
+
   // Resolves one `dependsOn` entry of `frame`'s task into its edges.
   function resolveEntry(frame: Frame, raw: string): void {
     const { node } = frame
@@ -451,7 +519,14 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
       // shape), and a cycle walks the frontier straight back to the
       // origin. Mirrors the self-pattern rule above — a task can never
       // depend on itself.
+      //
+      // The default `build` sits on every project, so on a package cycle it
+      // would make a task cycle no config declares. Its own walk passes
+      // through the projects on its cycle (each of their builds reaches it),
+      // and a walk that meets it on a cycle takes the edge and goes on past
+      // it, so the builds it could not depend on still come first.
       const re = isTaskPattern(spec.task) ? compileTaskPattern(spec.task) : null
+      const keyed = isKeyedGroup(node.config)
       const visited = new Set<string>([projectName])
       const frontier = [...packageGraph.directDeps(projectName)]
       let held = false
@@ -460,8 +535,15 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
         if (visited.has(target)) continue
         visited.add(target)
         if (re === null) {
-          if (visit(frame, target, spec.task, false)) held = true
-          else frontier.push(...packageGraph.directDeps(target))
+          if (keyed && sameCycle(projectName, target)) {
+            frontier.push(...packageGraph.directDeps(target))
+          } else if (visit(frame, target, spec.task, false)) {
+            held = true
+            const task = declaredTask(projects.get(target)!.config, spec.task)!
+            if (isKeyedGroup(task) && onCycle(target)) {
+              frontier.push(...packageGraph.directDeps(target))
+            }
+          } else frontier.push(...packageGraph.directDeps(target))
         } else {
           const names = Object.keys(projects.get(target)?.config.tasks ?? {}).filter((n) =>
             re.test(n),
@@ -975,36 +1057,51 @@ const GLOB_HEAD_END = /[*?{}\\!]/
  * directory its own head names. A whole subtree meets the globs whose
  * literal prefix lies at or under it, found the same way from the glob's
  * side (item 941).
+ *
+ * Given `sideOf`, only the pairs whose members sit on different sides are
+ * wanted (a reader and a writer, `detectInputOverlaps`), and each index is
+ * kept per side, so a member looks up only the other side's: thousands of
+ * readers sharing one input (`src/**`, a root `tsconfig.base.json`) were
+ * paired with each other, millions of pairs no rule judges (X-101).
  */
 function overlapCandidates<T>(
   tasks: readonly T[],
   globsOf: (n: T) => readonly string[] | undefined,
+  sideOf?: (n: T) => boolean,
 ): Array<[number, number]> {
-  const globs = new Map<string, number[]>()
-  const globsUnder = new Map<string, number[]>()
+  const sides = sideOf === undefined ? 1 : 2
+  // The index a member of side `s` looks up: its own side's, or the other's.
+  const across = (s: number): number => (sides === 1 ? s : 1 - s)
+  const perSide = (): Array<Map<string, number[]>> =>
+    Array.from({ length: sides }, () => new Map<string, number[]>())
+  const globs = perSide()
+  const globsUnder = perSide()
   const literals: Array<[task: number, path: string]> = []
   // `covers` (item 941): a whole subtree `P/**` meets every glob whose
   // literal prefix is P or under it, so each glob looks up the subtrees
   // filed at its prefix and at each of that prefix's ancestors.
-  const subtrees = new Map<string, number[]>()
+  const subtrees = perSide()
   const prefixes: Array<[task: number, prefix: string]> = []
   const file = (index: Map<string, number[]>, key: string, i: number): void => {
     const list = index.get(key)
     if (list === undefined) index.set(key, [i])
     else list.push(i)
   }
+  const side: number[] = []
   for (let i = 0; i < tasks.length; i++) {
+    const s = sideOf?.(tasks[i]!) === true ? 1 : 0
+    side.push(s)
     for (const tree of asTrees(globsOf(tasks[i]!) ?? [])) {
       if (isLiteralPattern(tree)) {
         literals.push([i, tree])
         continue
       }
-      file(globs, tree, i)
+      file(globs[s]!, tree, i)
       const dir = wholeSubtreePrefixes([tree])?.[0]
-      if (dir !== undefined) file(subtrees, dir, i)
+      if (dir !== undefined) file(subtrees[s]!, dir, i)
       prefixes.push([i, staticPrefix(tree)])
       const head = tree.slice(0, tree.search(GLOB_HEAD_END))
-      file(globsUnder, head.slice(0, Math.max(0, head.lastIndexOf('/'))), i)
+      file(globsUnder[s]!, head.slice(0, Math.max(0, head.lastIndexOf('/'))), i)
     }
   }
   const n = tasks.length
@@ -1012,34 +1109,38 @@ function overlapCandidates<T>(
   const pair = (x: number, y: number): void => {
     if (x !== y) pairs.add(x < y ? x * n + y : y * n + x)
   }
-  for (const list of globs.values()) {
+  for (const [tree, list] of globs[0]!) {
+    const other = sides === 1 ? list : (globs[1]!.get(tree) ?? [])
     for (let x = 0; x < list.length; x++) {
-      for (let y = x + 1; y < list.length; y++) pair(list[x]!, list[y]!)
+      for (let y = sides === 1 ? x + 1 : 0; y < other.length; y++) pair(list[x]!, other[y]!)
     }
   }
   // `witnessed`: two globs meet only when one's literal prefix is the
   // other's or under it, so each looks up the globs filed at its prefix
   // and at each ancestor.
-  const byPrefix = new Map<string, number[]>()
-  for (const [i, prefix] of prefixes) file(byPrefix, rootless(prefix), i)
+  const byPrefix = perSide()
+  for (const [i, prefix] of prefixes) file(byPrefix[side[i]!]!, rootless(prefix), i)
   for (const [i, raw] of prefixes) {
+    const index = byPrefix[across(side[i]!)]!
     const prefix = rootless(raw)
-    for (const j of byPrefix.get(prefix) ?? []) pair(i, j)
-    if (prefix !== '') for (const j of byPrefix.get('') ?? []) pair(i, j)
+    for (const j of index.get(prefix) ?? []) pair(i, j)
+    if (prefix !== '') for (const j of index.get('') ?? []) pair(i, j)
     for (let sep = prefix.indexOf('/'); sep !== -1; sep = prefix.indexOf('/', sep + 1)) {
-      for (const j of byPrefix.get(prefix.slice(0, sep)) ?? []) pair(i, j)
+      for (const j of index.get(prefix.slice(0, sep)) ?? []) pair(i, j)
     }
   }
   for (const [i, prefix] of prefixes) {
-    for (const j of subtrees.get(prefix) ?? []) pair(i, j)
+    const index = subtrees[across(side[i]!)]!
+    for (const j of index.get(prefix) ?? []) pair(i, j)
     for (let sep = prefix.indexOf('/'); sep !== -1; sep = prefix.indexOf('/', sep + 1)) {
-      for (const j of subtrees.get(prefix.slice(0, sep)) ?? []) pair(i, j)
+      for (const j of index.get(prefix.slice(0, sep)) ?? []) pair(i, j)
     }
   }
   for (const [i, path] of literals) {
-    for (const j of globsUnder.get('') ?? []) pair(i, j)
+    const index = globsUnder[across(side[i]!)]!
+    for (const j of index.get('') ?? []) pair(i, j)
     for (let sep = path.indexOf('/'); sep !== -1; sep = path.indexOf('/', sep + 1)) {
-      for (const j of globsUnder.get(path.slice(0, sep)) ?? []) pair(i, j)
+      for (const j of index.get(path.slice(0, sep)) ?? []) pair(i, j)
     }
   }
   return [...pairs].sort((x, y) => x - y).map((p) => [Math.floor(p / n), p % n])
@@ -1236,7 +1337,11 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   if (projectReaders) {
     for (const sides of byProject.values()) {
       if (sides.length < 2) continue
-      for (const [i, j] of overlapCandidates(sides, (s) => s.globs)) {
+      for (const [i, j] of overlapCandidates(
+        sides,
+        (s) => s.globs,
+        (s) => s.reads,
+      )) {
         readsOutputs(sides[i]!, sides[j]!, 'files')
       }
     }
@@ -1251,7 +1356,11 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       rooted.push({ node, globs, reads: false, rel })
     }
   }
-  for (const [i, j] of overlapCandidates(rooted, (s) => s.globs)) {
+  for (const [i, j] of overlapCandidates(
+    rooted,
+    (s) => s.globs,
+    (s) => s.reads,
+  )) {
     readsOutputs(rooted[i]!, rooted[j]!, 'workspaceFiles')
   }
 }

package/src/orchestrator/admission.ts

@@ -27,7 +27,10 @@ import { computeTaskHash, type ComputeHashArgs } from './task-hash.js'
 
 /** What `taintTracker` answers per dispatch, and what it learns per finish. */
 export interface TaintTracker {
-  /** Whether `node`, dispatched with these `upstream` outcomes, builds on bytes nothing vouches for. */
+  /**
+   * Whether `node`, dispatched with these key `upstream` outcomes, builds on
+   * bytes nothing vouches for. Its order-only deps count too.
+   */
   judge: (node: TaskNode, upstream: TaskOutcome[]) => boolean
   /** Every settled outcome, the scheduler's `onFinish`. */
   settled: (outcome: TaskOutcome) => void
@@ -102,8 +105,14 @@ export function taintTracker(
   }
   return {
     // A restore-tier task may run before its deps and see holes here; it
-    // never saves anyway (a hit restores), so a hole is not taint.
-    judge: (node, upstream) => seeds.has(node.id) || upstream.some(through),
+    // never saves anyway (a hit restores), so a hole is not taint. The
+    // upstream is the key's, which drops order-only edges; their failure
+    // reaches the task through the dependency `--exclude-dependencies`
+    // took out, so they are read from the settled outcomes.
+    judge: (node, upstream) =>
+      seeds.has(node.id) ||
+      upstream.some(through) ||
+      node.orderOnly?.some((d) => through(outcomes.get(d))) === true,
     settled: (outcome) => {
       outcomes.set(outcome.node.id, outcome)
     },

package/src/orchestrator/events.ts

@@ -13,6 +13,15 @@ import { maskedCommand, secretMask } from '../util/index.js'
 import type { Logger } from './logger.js'
 import type { RunContext } from './summary.js'
 
+/**
+ * A task no cache answered for: it declares no `cache`, or the run's policy
+ * read and wrote nothing. Its run is `no-cache`, never a miss, on every
+ * surface — `--dry`'s plan, the frame, the footer, `--report`, `--summarize`.
+ */
+export function ranNoCache(o: { node: TaskNode; cacheOff?: boolean }): boolean {
+  return o.node.config.cache === undefined || o.cacheOff === true
+}
+
 /** Payload of the `run:start` event — mirrors the Logger.runStart hook. */
 export interface RunStartInfo {
   total: number
@@ -373,7 +382,7 @@ export function projectOutcome(outcome: TaskOutcome): OutcomeView {
     durationMs: outcome.durationMs,
   }
   if (isGroupTask(outcome.node)) view.isGroup = true
-  else if (outcome.node.config.cache === undefined) view.noCache = true
+  else if (ranNoCache(outcome)) view.noCache = true
   if (outcome.storedDurationMs !== undefined) view.storedDurationMs = outcome.storedDurationMs
   if (outcome.storedCpuMs !== undefined) view.storedCpuMs = outcome.storedCpuMs
   if (outcome.storedPeakRssBytes !== undefined) view.storedPeakRssBytes = outcome.storedPeakRssBytes

package/src/orchestrator/execute-task.ts

@@ -362,12 +362,17 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
       args.cacheDir,
     )
     placeholders = sb.placeholders
+    // A wrap that refuses (a port the host holds) leaves the server unspawned
+    // and the placeholders vx made for it in the project for every later run.
     const wrapped = await wrapSandboxedCommand({
       command: plainCommand,
       cwd: node.projectDir,
       env,
       ...sb.sandbox,
       server: true,
+    }).catch(async (err: unknown) => {
+      await sweepPlaceholders(placeholders)
+      throw err
     })
     command = wrapped.wrapped
     bridgeTag = wrapped.tag
@@ -949,15 +954,21 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     const endReq = span('miss: build request')
     const req = await buildRequest()
     endReq()
-    // An executor that THROWS produces no captured output, so the task's
-    // frame would print the command and nothing else while the reason went
-    // straight to stderr and scrolled away in a broad run. Put it in the
-    // task's own stream first: the frame is where a reader looks for why a
-    // task failed, and a remote executor's failures are exactly the ones with
-    // no other trace. Rethrown unchanged — the scheduler still classifies it,
-    // and still prints it plainly for a UserError.
+    // An executor that THROWS produces no captured output. Rethrown: the
+    // scheduler classifies it and prints its one line into the task's own
+    // stream (run()'s onError), where the frame reads it; a copy written
+    // here too printed the reason twice.
     const endExec = span('miss: execute')
-    let res = await boundAfterAbort(args.executor.execute(req), req.signal)
+    // A plugin's execute may throw before returning or return a bare result:
+    // the throw is its rejection, the value its resolution, so both reach
+    // the naming catch and the cleanup in finally below.
+    let running: Promise<unknown>
+    try {
+      running = Promise.resolve(args.executor.execute(req))
+    } catch (thrown) {
+      running = Promise.reject(thrown)
+    }
+    let res = await boundAfterAbort(running, req.signal)
       .then((r: unknown) => {
         assertExecuteResult(args.executor.name, node.id, r)
         return r
@@ -981,15 +992,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         }
         const err = nameExecutorFailure(args.executor, raw)
         // A remote executor's message carries the server's own text, which
-        // may echo the env it was sent: masked here, where it is printed,
-        // and on the error the scheduler prints with its cause (L-39).
+        // may echo the env it was sent: masked on the error the scheduler
+        // prints with its cause (L-39).
         if (secrets !== null) {
           for (const e of [err, err instanceof Error ? err.cause : undefined])
             if (e instanceof Error) e.message = secrets.mask(e.message)
         }
-        const message =
-          err instanceof Error ? err.message : (secrets?.mask(String(err)) ?? String(err))
-        log.taskStderr(node, `${message}\n`)
         await sweepPlaceholders(placeholders)
         throw err
       })
@@ -1141,6 +1149,21 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     args.executor.remote === true ? 'none' : undeclaredWriteReach(node, args.workspaceRoot)
   const writesFingerprint =
     args.executor.remote !== true && mayWriteFingerprint(node, args.workspaceRoot)
+  // A stop that landed during the awaits above (the key, the probe, the
+  // input description): the first attempt would wipe the last build and
+  // hand the executor a request after the run had stopped. Through a call,
+  // so the loop's own reads of the stop are not narrowed to false.
+  if (isAborted(args.stopSignal)) {
+    return {
+      node,
+      status: 'aborted',
+      exitCode: signalExitCode(forwardedSignal(args.stopSignal?.reason)),
+      durationMs: 0,
+      hash,
+      wallclockStartNs,
+      wallclockEndNs: process.hrtime.bigint() - args.runStartHrTimeNs,
+    }
+  }
   for (;;) {
     attempt++
     const a = await runAttempt()

package/src/orchestrator/failure-mode.ts

@@ -29,6 +29,8 @@ export type FailureMode = 'stable' | 'flaky-recoverable' | 'flaky-fatal'
 function keyOutcomesSql(source: string, where = ''): string {
   return `SELECT project, task, hash,
        SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failures,
+       SUM(CASE WHEN status = 'success' AND attempts > 1 THEN attempts - 1 ELSE 0 END)
+         AS retried_failures,
        SUM(CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
            THEN 1 ELSE 0 END) AS passes
        FROM ${source}
@@ -186,13 +188,17 @@ export interface FlakyTask {
 /**
  * Every task with a mixed-outcome key anywhere in the retained history
  * (30 days, `RunHistory.pruneOlderThan`), most failures first: the
- * doctor's list. A full scan of `runs`, which an inspection verb affords.
+ * doctor's list. A pass that took a retry mixes its key on its own: it is
+ * one `success` row whose failed attempts count as failures (`vx info`
+ * said `none` over one). A full scan of `runs`, which an inspection verb
+ * affords.
  */
 export function flakyTasks(db: Database): FlakyTask[] {
   const rows = db
     .query(
       `SELECT project, task, COUNT(*) AS keys, SUM(passes) AS passes, SUM(failures) AS failures
-       FROM (${keyOutcomesSql('runs')})
+       FROM (SELECT project, task, passes, failures + retried_failures AS failures
+             FROM (${keyOutcomesSql('runs')}))
        WHERE failures > 0 AND passes > 0
        GROUP BY project, task
        ORDER BY failures DESC, passes DESC, project, task`,

package/src/orchestrator/framed-output.ts

@@ -30,7 +30,7 @@ import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { maskedCommand } from '../util/index.js'
 import { paint, type ColorSupport } from './colors.js'
 import { formatDuration, neverStarted } from './summary.js'
-import { outcomeLabel, skippedReason } from './events.js'
+import { outcomeLabel, ranNoCache, skippedReason } from './events.js'
 
 const NO_COLOR: ColorSupport = { enabled: false }
 
@@ -274,8 +274,8 @@ function cacheOf(o: TaskOutcome): { word: string; color: string } {
   switch (o.status) {
     case 'success':
     case 'failed':
-      // A task with no `cache` block never consulted the cache: not a miss.
-      return { word: o.node.config.cache === undefined ? 'no-cache' : 'miss', color: '' } // dim
+      // A task no cache answered for never consulted one: not a miss.
+      return { word: ranNoCache(o) ? 'no-cache' : 'miss', color: '' } // dim
     case 'cache-hit':
       return o.restored === false
         ? { word: 'fresh', color: SUCCESS }

package/src/orchestrator/logger.ts

@@ -23,7 +23,7 @@ import { formatDuration, formatSummarySection, neverStarted, type RunContext } f
 import { isGroupTask } from '../graph/index.js'
 import { appendTail, createTail, resetTail, tailText, type Tail } from '../util/index.js'
 import { isCacheHit } from './telemetry.js'
-import { failedLabel, outcomeWord } from './events.js'
+import { failedLabel, outcomeWord, ranNoCache } from './events.js'
 
 export interface Logger {
   /** Header / footer / status text. Written verbatim, one trailing \n added. */
@@ -139,8 +139,7 @@ function ghaFence(body: string, token: string): string {
   return `::stop-commands::${token}\n${body}::${token}::\n`
 }
 
-const cacheWordOf = (n: TaskNode): 'miss' | 'no-cache' =>
-  n.config.cache === undefined ? 'no-cache' : 'miss'
+const cacheWordOf = (o: TaskOutcome): 'miss' | 'no-cache' => (ranNoCache(o) ? 'no-cache' : 'miss')
 
 export function resolveOutputView(
   options: {
@@ -440,7 +439,7 @@ export function defaultLogger(
     (view.mode === 'focused' && isPrimary(node) && !isGroupTask(node) && requestedCount <= 1)
 
   const failureRow = (node: TaskNode, outcome: TaskOutcome): string =>
-    formatFailureLine(node.id, outcome.durationMs, colors, cacheWordOf(node)) +
+    formatFailureLine(node.id, outcome.durationMs, colors, cacheWordOf(outcome)) +
     flakyNote(outcome, colors)
 
   return {
@@ -453,6 +452,12 @@ export function defaultLogger(
       // A kept server's held partial line is older than this line: held
       // past it, a server's last words printed below its own exit notice.
       flushKept()
+      // A live-streamed server keeps writing after its frame closes, so a
+      // summary row or "exited with code" can follow its partial line.
+      if (streamMidLine) {
+        writer.write('\n')
+        streamMidLine = false
+      }
       writer.write(`${line}\n`)
     },
     runStart(info) {
@@ -654,7 +659,7 @@ export function defaultLogger(
         done++
         if (outcome.status === 'failed') {
           failed++
-          if (node.config.cache === undefined) noCache++
+          if (ranNoCache(outcome)) noCache++
         } else if (node.config.exec?.persistent !== undefined && outcome.status === 'success') {
           // A persistent task's outcome arrives at READY; the child
           // keeps running until the orchestrator SIGTERMs it at run
@@ -678,7 +683,7 @@ export function defaultLogger(
         switch (outcome.status) {
           case 'success':
             succeeded++
-            if (node.config.cache === undefined) noCache++
+            if (ranNoCache(outcome)) noCache++
             break
           case 'cache-hit':
             if (outcome.restored === false) upToDate++

package/src/orchestrator/metrics.ts

@@ -407,11 +407,18 @@ function unchangedKeyNote(
       at: number
     } | null
   )?.at
-  // Both runs executed the task and succeeded with the cache writable, no
-  // entry holds the key, and each ran beside a failure: the continue-taint
-  // (admission.ts), which runs a task downstream of a failure and never
-  // saves it. Blaming `--no-cache` / `--force` named a flag nobody passed.
-  if (createdAt === undefined && this_.status === 'success' && prev.status === 'success') {
+  // The previous run executed the task and succeeded with the cache
+  // writable beside a failure, and no entry older than this run holds the
+  // key: the continue-taint (admission.ts), which runs a task downstream of
+  // a failure and never saves it. Blaming `--no-cache` / `--force` named a
+  // flag nobody passed, and a prune when this run saved the key named an
+  // eviction that never happened.
+  if (
+    (createdAt === undefined || createdAt >= this_.startedAt) &&
+    this_.status === 'success' &&
+    prev.status === 'success' &&
+    prev.cacheHit === 0
+  ) {
     const failedWithWrites = (id: string | null): number => {
       if (id === null) return 0
       const row = db
@@ -420,9 +427,13 @@ function unchangedKeyNote(
       const writes = row?.p.split(',').some((axis) => axis === 'lW' || axis === 'rW') === true
       return writes ? (row?.f ?? 0) : 0
     }
-    const now = failedWithWrites(runId)
-    if (prev.cacheHit === 0 && now > 0 && failedWithWrites(prev.runId) > 0) {
-      return `cache key unchanged — neither run saved it: each ran beside a failed task (${now} failed in this one), and a task run past a failed dependency (--continue) is never cached`
+    const before = failedWithWrites(prev.runId)
+    if (before > 0) {
+      const now = failedWithWrites(runId)
+      if (createdAt === undefined && now > 0) {
+        return `cache key unchanged — neither run saved it: each ran beside a failed task (${now} failed in this one), and a task run past a failed dependency (--continue) is never cached`
+      }
+      return `cache key unchanged — the previous run on this key ran beside a failed task (${before} failed in it) and was not saved: a task run past a failed dependency (--continue) is never cached, so there was nothing to hit`
     }
   }
   if (createdAt !== undefined && createdAt >= this_.startedAt) {

package/src/orchestrator/miss-save.ts

@@ -70,8 +70,8 @@ export interface SaveMissArgs {
   nestedProjectDirs: string[]
   gitFilesCache?: GitFilesCache | undefined
   /** Declared `cache.outputs.files` / `.workspaceFiles`. */
-  outputs: string[]
-  wsOutputs: string[]
+  outputs: readonly string[]
+  wsOutputs: readonly string[]
   /**
    * An ADDITIVE task's own set (item 588): the files its run added or
    * changed under its declared outputs, resolved by execute-task against

package/src/orchestrator/options.ts

@@ -171,6 +171,13 @@ export interface RunOptions {
    * else is treated as the literal file path (cwd-relative).
    */
   summarize?: string
+  /**
+   * Text printed just above the run's footer, given the outcomes the
+   * footer counts, after the `summaryTable`: nothing prints below the
+   * footer (owner), so a caller's end-of-run report (`--report`) rides
+   * here. Not called on a refused run.
+   */
+  beforeFooter?: (outcomes: readonly TaskOutcome[], ok: boolean) => string
   /**
    * If set, write a Chrome-trace JSON profile of the run's wallclock
    * spans. Path is cwd-relative. Default `profile.json` is selected

package/src/orchestrator/plan.ts

@@ -12,7 +12,8 @@
 // side-effect-free pure probes.
 
 import type { CacheLayer, CachePolicy, GitFilesCache } from '../cache/index.js'
-import { FULL_CACHE_POLICY } from '../cache/index.js'
+import { cachesNothing, FULL_CACHE_POLICY } from '../cache/index.js'
+import { ranNoCache } from './events.js'
 import {
   idleServers,
   isGroupTask,
@@ -169,9 +170,8 @@ export async function plan(args: PlanArgs): Promise<RunPlan> {
       // policy-aware cache layer, which itself respects read gating.
       const policy = args.cachePolicy ?? FULL_CACHE_POLICY
       const reads = policy.localRead || policy.remoteRead
-      const writes = policy.localWrite || policy.remoteWrite
       let status: CacheStatus
-      if (node.config.cache === undefined || (!reads && !writes)) {
+      if (ranNoCache({ node, cacheOff: cachesNothing(policy) })) {
         status = 'no-cache'
       } else if (!reads) {
         status = 'miss'