@vzn/vx 0.0.595 → 0.0.597

package/src/orchestrator/execute-task.ts

@@ -362,12 +362,17 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
       args.cacheDir,
     )
     placeholders = sb.placeholders
+    // A wrap that refuses (a port the host holds) leaves the server unspawned
+    // and the placeholders vx made for it in the project for every later run.
     const wrapped = await wrapSandboxedCommand({
       command: plainCommand,
       cwd: node.projectDir,
       env,
       ...sb.sandbox,
       server: true,
+    }).catch(async (err: unknown) => {
+      await sweepPlaceholders(placeholders)
+      throw err
     })
     command = wrapped.wrapped
     bridgeTag = wrapped.tag
@@ -519,11 +524,10 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // exited before ready keeps its own exit code rather than a made-up 1.
     // One the readiness timeout is killing reports the signal's, as an
     // ordinary timeout does (X-24).
+    // A readiness timeout rejects once the group is gone (runner.ts), so a
+    // server that ignored the TERM holds no port into the next `vx watch`
+    // cycle, and a second signal here would cut a one-shot handler short.
     const ready = err instanceof PersistentReadyError ? err : undefined
-    // The timer's SIGKILL is a grace away and the shell may die on the
-    // TERM first: a server that ignores it held its port past run() into
-    // the next `vx watch` cycle. Return once the group is gone.
-    if (ready?.reason === 'timeout') await terminateChildren(() => [spawn.child])
     return {
       node,
       status: 'failed',
@@ -632,7 +636,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // `signal` stops a plugin executor on the run's stop AND on
   // `exec.timeout`: core cannot kill a process an executor spawned, so a
   // declared timeout meant nothing on one that kept its own clock (H-12).
-  // The local executor keeps its own timer (it signals the process group).
+  // The local executor keeps its own timer from the spawn (it signals the
+  // process group), so its request carries no clock: armed here, it also
+  // timed the sandbox's wrap, and a wrap slower than the timeout aborted
+  // the request before the spawn — a task reported killed, never run.
   let timeoutTimer: ReturnType<typeof setTimeout> | undefined
   let timeoutFired = false
   // The attempt's listener on the run's stop signal, taken off once the
@@ -640,7 +647,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // grew to the task count, and each add scans it for a duplicate, ~100 ms
   // of a 1,000-task cold run.
   let unlistenStop: (() => void) | undefined
-  function requestSignal(): AbortSignal {
+  function requestSignal(local: boolean): AbortSignal {
     const stop = new AbortController()
     const abort = (): void => stop.abort(args.stopSignal?.reason)
     unlistenStop?.()
@@ -651,9 +658,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       run.addEventListener('abort', abort, { once: true })
       unlistenStop = () => run.removeEventListener('abort', abort)
     }
-    if (effectiveTimeout !== undefined) {
-      clearTimeout(timeoutTimer)
-      timeoutFired = false
+    clearTimeout(timeoutTimer)
+    timeoutFired = false
+    if (effectiveTimeout !== undefined && !local) {
       timeoutTimer = setTimeout(() => {
         timeoutFired = true
         stop.abort(new Error(`timed out after ${effectiveTimeout}ms`))
@@ -803,7 +810,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
     if (preProbed !== undefined) {
       if (preProbed.hit !== null) {
-        const restored = await restoreOrMiss(preProbed.hit)
+        // A key taken before a task rewrote the lockfile names an install
+        // the tree no longer holds, and the lazy path below never probes
+        // one (X-124): demoted like a vanished hit, it runs dep-gated.
+        const restored = fingerprintMoved() ? null : await restoreOrMiss(preProbed.hit)
         if (restored !== null) return restored
         // The up-front probe's hit may be restoring AHEAD of this task's
         // deps, and a command run now would build from outputs they have
@@ -912,6 +922,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   async function runAttempt(): Promise<{
     result: ExecuteResult
     exitCode: number
+    withdrawn?: true
   }> {
     // A deferred task's outputs are deliberately NOT coming, so wiping the
     // tree would replace a stale build with nothing at all. The eligibility
@@ -947,17 +958,33 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
     violations = []
     const endReq = span('miss: build request')
-    const req = await buildRequest()
+    const req = await buildRequest(isLocalExecutor(args.executor))
     endReq()
-    // An executor that THROWS produces no captured output, so the task's
-    // frame would print the command and nothing else while the reason went
-    // straight to stderr and scrolled away in a broad run. Put it in the
-    // task's own stream first: the frame is where a reader looks for why a
-    // task failed, and a remote executor's failures are exactly the ones with
-    // no other trace. Rethrown unchanged — the scheduler still classifies it,
-    // and still prints it plainly for a UserError.
+    // A sibling's failure under --continue=never can land while a retry
+    // cleans or builds its request, after the loop's own check: the retry
+    // is withdrawn and the attempt before it stands.
+    if (attempt > 1 && args.failFast?.aborted === true) {
+      clearTimeout(timeoutTimer)
+      unlistenStop?.()
+      unlistenStop = undefined
+      await sweepPlaceholders(placeholders)
+      return { result, exitCode: effectiveExitCode, withdrawn: true }
+    }
+    // An executor that THROWS produces no captured output. Rethrown: the
+    // scheduler classifies it and prints its one line into the task's own
+    // stream (run()'s onError), where the frame reads it; a copy written
+    // here too printed the reason twice.
     const endExec = span('miss: execute')
-    let res = await boundAfterAbort(args.executor.execute(req), req.signal)
+    // A plugin's execute may throw before returning or return a bare result:
+    // the throw is its rejection, the value its resolution, so both reach
+    // the naming catch and the cleanup in finally below.
+    let running: Promise<unknown>
+    try {
+      running = Promise.resolve(args.executor.execute(req))
+    } catch (thrown) {
+      running = Promise.reject(thrown)
+    }
+    let res = await boundAfterAbort(running, req.signal)
       .then((r: unknown) => {
         assertExecuteResult(args.executor.name, node.id, r)
         return r
@@ -973,23 +1000,19 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
             raw = new UserError(`${why}, and remote: 'only' keeps it off this machine`)
           } else {
             log.status(`[vx] ${node.id}: ${why} — running it here`)
-            clearTimeout(timeoutTimer)
-            const local = await localExecutor().execute(await buildRequest())
+            const local = await localExecutor().execute(await buildRequest(true))
             assertExecuteResult('local', node.id, local)
             return local
           }
         }
         const err = nameExecutorFailure(args.executor, raw)
         // A remote executor's message carries the server's own text, which
-        // may echo the env it was sent: masked here, where it is printed,
-        // and on the error the scheduler prints with its cause (L-39).
+        // may echo the env it was sent: masked on the error the scheduler
+        // prints with its cause (L-39).
         if (secrets !== null) {
           for (const e of [err, err instanceof Error ? err.cause : undefined])
             if (e instanceof Error) e.message = secrets.mask(e.message)
         }
-        const message =
-          err instanceof Error ? err.message : (secrets?.mask(String(err)) ?? String(err))
-        log.taskStderr(node, `${message}\n`)
         await sweepPlaceholders(placeholders)
         throw err
       })
@@ -1008,11 +1031,11 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         stdout: maskCaptured(res.stdout, secrets),
         stderr: maskCaptured(res.stderr, secrets),
       }
-    // An executor that stopped on the timeout's abort exits non-zero; say
-    // why, so the frame, the retry line and `timedOut` read as a timeout.
-    if (timeoutFired && res.exitCode !== 0 && res.timedOut !== true) {
-      res = { ...res, timedOut: true }
-    }
+    // An executor that stopped on the timeout's abort timed out, whatever
+    // its exit: a child that traps the TERM and exits 0 left partial outputs
+    // a pass would save (X-125), as the local runner's own `timedOut` says.
+    // A local request carries no timer, so the runner alone decides there.
+    if (timeoutFired && res.timedOut !== true) res = { ...res, timedOut: true }
     violations = [...res.violations]
     // A denial under a dependency the key does not answer for says only
     // ENOENT; the line beside it names the package and how to key it. Only
@@ -1141,13 +1164,33 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     args.executor.remote === true ? 'none' : undeclaredWriteReach(node, args.workspaceRoot)
   const writesFingerprint =
     args.executor.remote !== true && mayWriteFingerprint(node, args.workspaceRoot)
+  // A stop that landed during the awaits above (the key, the probe, the
+  // input description): the first attempt would wipe the last build and
+  // hand the executor a request after the run had stopped. Through a call,
+  // so the loop's own reads of the stop are not narrowed to false.
+  if (isAborted(args.stopSignal)) {
+    return {
+      node,
+      status: 'aborted',
+      exitCode: signalExitCode(forwardedSignal(args.stopSignal?.reason)),
+      durationMs: 0,
+      hash,
+      wallclockStartNs,
+      wallclockEndNs: process.hrtime.bigint() - args.runStartHrTimeNs,
+    }
+  }
   for (;;) {
     attempt++
     const a = await runAttempt()
-    forgetUndeclaredWrites(args, writeReach)
-    if (writesFingerprint) args.fingerprintWatch?.wrote()
     result = a.result
     effectiveExitCode = a.exitCode
+    if (a.withdrawn) {
+      attempt--
+      failedAttempts.pop()
+      break
+    }
+    forgetUndeclaredWrites(args, writeReach)
+    if (writesFingerprint) args.fingerprintWatch?.wrote()
     spentMs += result.durationMs
 
     // An attempt that ended in a shutdown never finished on its own terms —
@@ -1196,7 +1239,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
   }
 
-  async function buildRequest(): Promise<ExecuteRequest> {
+  async function buildRequest(local: boolean): Promise<ExecuteRequest> {
     const out = secrets && maskedEmitter(secrets, (t) => log.taskStdout(node, t))
     const err = secrets && maskedEmitter(secrets, (t) => log.taskStderr(node, t))
     flushMasked = () => {
@@ -1234,10 +1277,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       outputs: { files: outputs, workspaceFiles: wsOutputs },
       ...(args.terminal === true ? { terminal: true as const } : {}),
     }
-    // The signal last: it arms `exec.timeout`, and the sandbox's arming
+    // The signal last: it arms a plugin's `exec.timeout`, and the sandbox's arming
     // below is vx's work, not the task's. Armed first, a 60 ms timeout
     // expired before the spawn and failed `echo` as timed out, unrun.
-    if (!userSandbox) return { ...base, signal: requestSignal() }
+    if (!userSandbox) return { ...base, signal: requestSignal(local) }
     await args.armSandbox?.()
     const sb = await sandboxRequestFor(
       node,
@@ -1249,7 +1292,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
     placeholders = sb.placeholders
     withheld = sb.withheld
-    return { ...base, sandbox: sb.sandbox, signal: requestSignal() }
+    return { ...base, sandbox: sb.sandbox, signal: requestSignal(local) }
   }
 
   const wallclockEndNs = process.hrtime.bigint() - args.runStartHrTimeNs
@@ -1260,12 +1303,15 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // record (a row with no artifact) is exactly the corrupt-entry shape
     // `restoreOutputs` refuses, so writing none is the only clean answer.
     // The closure is what a later local consumer — or a later eager run —
-    // pulls the bytes with.
+    // pulls the bytes with. Its fetch saves them under `hash` only past the
+    // eager save's check: an input edited before the describe filed the
+    // edit's bytes under the old key (X-123).
     const materialize = result.outputs?.kind === 'deferred' ? result.outputs.materialize : undefined
     if (materialize !== undefined) {
+      const keyed = await keyStillTrue()
       args.deferred?.register(node.id, {
         materialize,
-        hash,
+        ...(keyed ? { hash } : {}),
         entry: {
           taskId: node.id,
           command: storedCommand,

package/src/orchestrator/failure-mode.ts

@@ -21,32 +21,40 @@ export type FailureMode = 'stable' | 'flaky-recoverable' | 'flaky-fatal'
 
 /**
  * Per-key outcome projection: every keyed (project, task, hash) under
- * `source` (a relation with `project`, `task`, `hash`, `status`, `cache_hit`
- * columns) with how often it failed and how often it passed — a pass being
- * an executed success or a cache hit, which replays a success. Every
+ * `source` (`runs`, or a relation with its `id`, `project`, `task`, `hash`,
+ * `status`, `cache_hit` columns) with how often it failed, how often it
+ * passed — an executed success or a cache hit, which replays a success —
+ * and how often it failed AFTER its first pass (`relapses`). Every
  * flakiness reader is a filter over this one projection.
  */
 function keyOutcomesSql(source: string, where = ''): string {
-  return `SELECT project, task, hash,
-       SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failures,
-       SUM(CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
-           THEN 1 ELSE 0 END) AS passes
-       FROM ${source}
-       WHERE ${KEYED_RUNS_SQL}${where}
+  return `SELECT project, task, hash, SUM(failed) AS failures, SUM(passed) AS passes,
+       SUM(retried) AS retried_failures,
+       SUM(CASE WHEN failed = 1 AND id > first_pass THEN 1 ELSE 0 END) AS relapses
+       FROM (SELECT project, task, hash, id, failed, passed, retried,
+           MIN(CASE WHEN passed = 1 THEN id END) OVER (PARTITION BY project, task, hash) AS first_pass
+         FROM (SELECT project, task, hash, id,
+             CASE WHEN status = 'failed' THEN 1 ELSE 0 END AS failed,
+             CASE WHEN status = 'success' AND attempts > 1 THEN attempts - 1 ELSE 0 END AS retried,
+             CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
+               THEN 1 ELSE 0 END AS passed
+           FROM ${source}
+           WHERE ${KEYED_RUNS_SQL}${where}))
        GROUP BY project, task, hash`
 }
 
 /**
  * Per-key outcome subquery: the distinct cache keys under `source` that
- * produced BOTH a failure and a success — the definitional flake: identical
- * inputs, different outcomes. A failure whose key never succeeded is a
- * legitimate break (a changed input that fails), which belongs to the
- * regressions surface, not flakiness. One projection of the rule serves the
+ * FAILED AFTER THEY HAD PASSED — the definitional flake: identical inputs,
+ * a green result, then a red one. A failure whose key never succeeded is a
+ * legitimate break (a changed input that fails), and failures that end in
+ * a first pass are a recovery (a missing tool installed, a service brought
+ * up): neither is flakiness. One projection of the rule serves the
  * all-time query below and the windowed one in `history.ts`.
  */
 export function mixedOutcomeKeysSql(source: string, where = ''): string {
   return `SELECT project, task FROM (${keyOutcomesSql(source, where)})
-       WHERE failures > 0 AND passes > 0`
+       WHERE relapses > 0`
 }
 
 /** Mixed-outcome keys of one (project, task) over its WHOLE recorded history. */
@@ -61,7 +69,7 @@ export function mixedOutcomeKeyCount(db: Database, project: string, task: string
 
 /**
  * The verdict. Flaky requires a NONDETERMINISM signal: a within-run retry,
- * or a cache key that both failed and succeeded (`mixedKeys`). Failures
+ * or a cache key that failed after it had passed (`mixedKeys`). Failures
  * alone — each on its own key — are legitimate breaks, however many there
  * are. `mixedKeys` is a thunk so a task that never failed is stable without
  * the key count being computed at all.
@@ -118,9 +126,9 @@ const keyOf = (c: { project: string; task: string; hash: string }): string =>
 
 /**
  * Which of this run's executed tasks are flaky, judged BEFORE the run's own
- * rows are recorded: a pass on a key that has failed before, a failure on
- * a key that has passed before, or a within-run retry. The counts fold this
- * run in.
+ * rows are recorded: a failure on a key that has passed before, a pass on a
+ * key that already did so, or a within-run retry. A first pass after only
+ * failures is a recovery, not a flake. The counts fold this run in.
  *
  * The cost follows the run's colour. No candidate (every task a hit or a
  * skip): no query. A green miss: one probe of the `runs_failed` partial
@@ -146,7 +154,7 @@ export function detectFlaky(db: Database, candidates: readonly FlakyCandidate[])
     (c) => c.status === 'failed' || c.attempts > 1 || everFailed.has(keyOf(c)),
   )
   if (suspects.length === 0) return []
-  const counts = new Map<string, { passes: number; failures: number }>()
+  const counts = new Map<string, { passes: number; failures: number; relapses: number }>()
   chunked(suspects, (chunk) => {
     const rows = db
       .query(keyOutcomesSql('runs', ` AND hash IN (${chunk.map(() => '?').join(', ')})`))
@@ -156,27 +164,30 @@ export function detectFlaky(db: Database, candidates: readonly FlakyCandidate[])
       hash: string
       passes: number
       failures: number
+      relapses: number
     }[]
-    for (const r of rows) counts.set(keyOf(r), { passes: r.passes, failures: r.failures })
+    for (const r of rows)
+      counts.set(keyOf(r), { passes: r.passes, failures: r.failures, relapses: r.relapses })
   })
   const out: FlakyFinding[] = []
   for (const c of suspects) {
-    const before = counts.get(keyOf(c)) ?? { passes: 0, failures: 0 }
+    const before = counts.get(keyOf(c)) ?? { passes: 0, failures: 0, relapses: 0 }
+    const relapsed = c.status === 'failed' ? before.passes > 0 : before.relapses > 0
+    if (!relapsed && c.attempts <= 1) continue
     const passes = before.passes + (c.status === 'success' ? 1 : 0)
     const failures = before.failures + (c.status === 'failed' ? 1 : 0)
-    if (!(passes > 0 && failures > 0) && c.attempts <= 1) continue
     out.push({ ...c, taskId: `${c.project}#${c.task}`, passes, failures })
   }
   return out
 }
 
-/** One task the recorded history shows both passing and failing on unchanged inputs. */
+/** One task the recorded history shows failing on a key that had passed. */
 export interface FlakyTask {
   /** `project#task`. */
   taskId: string
   project: string
   task: string
-  /** Distinct cache keys that both passed and failed. */
+  /** Distinct cache keys that failed after they had passed. */
   keys: number
   /** Outcomes over those keys. */
   passes: number
@@ -184,16 +195,20 @@ export interface FlakyTask {
 }
 
 /**
- * Every task with a mixed-outcome key anywhere in the retained history
+ * Every task with a key that failed after it had passed anywhere in the retained history
  * (30 days, `RunHistory.pruneOlderThan`), most failures first: the
- * doctor's list. A full scan of `runs`, which an inspection verb affords.
+ * doctor's list. A pass that took a retry mixes its key on its own: it is
+ * one `success` row whose failed attempts count as failures (`vx info`
+ * said `none` over one). A full scan of `runs`, which an inspection verb
+ * affords.
  */
 export function flakyTasks(db: Database): FlakyTask[] {
   const rows = db
     .query(
       `SELECT project, task, COUNT(*) AS keys, SUM(passes) AS passes, SUM(failures) AS failures
-       FROM (${keyOutcomesSql('runs')})
-       WHERE failures > 0 AND passes > 0
+       FROM (SELECT project, task, passes, failures + retried_failures AS failures
+             FROM (${keyOutcomesSql('runs')})
+             WHERE relapses > 0 OR retried_failures > 0)
        GROUP BY project, task
        ORDER BY failures DESC, passes DESC, project, task`,
     )

package/src/orchestrator/framed-output.ts

@@ -27,10 +27,10 @@
 
 import { withForwardArgs } from '../exec/index.js'
 import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
-import { maskedCommand } from '../util/index.js'
+import { formatElapsed, maskedCommand } from '../util/index.js'
 import { paint, type ColorSupport } from './colors.js'
-import { formatDuration, neverStarted } from './summary.js'
-import { outcomeLabel, skippedReason } from './events.js'
+import { neverStarted } from './summary.js'
+import { outcomeLabel, ranNoCache, skippedReason } from './events.js'
 
 const NO_COLOR: ColorSupport = { enabled: false }
 
@@ -220,7 +220,7 @@ const CACHE_COL = 8 // "no-cache" / "remote" / "local" / "fresh" / "miss"
 
 /** Right-align the duration in a TIME_COL cell (pad on the left). */
 function timeCell(ms: number | null, colors: ColorSupport): string {
-  const raw = ms === null ? '' : formatDuration(ms)
+  const raw = ms === null ? '' : formatElapsed(ms)
   return ' '.repeat(Math.max(0, TIME_COL - raw.length)) + paint('', raw, colors, { dim: true })
 }
 
@@ -274,8 +274,8 @@ function cacheOf(o: TaskOutcome): { word: string; color: string } {
   switch (o.status) {
     case 'success':
     case 'failed':
-      // A task with no `cache` block never consulted the cache: not a miss.
-      return { word: o.node.config.cache === undefined ? 'no-cache' : 'miss', color: '' } // dim
+      // A task no cache answered for never consulted one: not a miss.
+      return { word: ranNoCache(o) ? 'no-cache' : 'miss', color: '' } // dim
     case 'cache-hit':
       return o.restored === false
         ? { word: 'fresh', color: SUCCESS }
@@ -487,7 +487,7 @@ export function formatFrameClose(
   // both ends of the frame as a long-lived task.
   const tail =
     persistent && outcome.status === 'success'
-      ? ` ${paint('', `(${formatDuration(outcome.durationMs)})`, colors, { dim: true })} ${paint(ACCENT, 'running', colors)}`
+      ? ` ${paint('', `(${formatElapsed(outcome.durationMs)})`, colors, { dim: true })} ${paint(ACCENT, 'running', colors)}`
       : formatBlockFooter(outcome, colors)
   const close = `${corner('└─')} ${mark}${paintTaskId(node, colors, { bold: true })} ${corner('──')}${tail}`
   const violations = violationSection(outcome, colors)
@@ -594,7 +594,7 @@ function formatBlockFooter(o: TaskOutcome, colors: ColorSupport): string {
   // saved" on the strength of it. The stored time lives on
   // `TaskOutcome.storedDurationMs`.) Status differs by outcome — see
   // formatStatusTag.
-  const dur = paint('', `(${formatDuration(o.durationMs)})`, colors, { dim: true })
+  const dur = paint('', `(${formatElapsed(o.durationMs)})`, colors, { dim: true })
   const tag = formatStatusTag(o, colors)
   return ` ${dur} ${tag}${flakyNote(o, colors)}`
 }

package/src/orchestrator/index.ts

@@ -30,7 +30,6 @@ export { defaultLogger, resolveOutputView } from './logger.js'
 export { detectColors, paint, type ColorSupport } from './colors.js'
 export type { Logger, OutputView } from './logger.js'
 export type { RunPlan, PlannedTask, PlanPrediction, CacheStatus } from './plan.js'
-export { formatDuration } from './summary.js'
 export {
   createEventBus,
   wireForwarder,

package/src/orchestrator/keyed-projects.ts

@@ -93,9 +93,12 @@ export function foldedDeps(node: TaskNode, nodeOf: (id: string) => TaskNode): Fo
  * the hashes are. An exec task's key folds its own id (`task:<id>`), so its
  * id is enough; a group's hash is a roll-up of its members' ids and hashes
  * with no id of its own, so two groups over the same members hash alike.
+ * The members are `keyUpstream`'s, which `computeGroupHash` is handed: under
+ * `--exclude-dependencies` `node.deps` holds order-only edges and lacks the
+ * dropped ones, and two groups the key told apart shared a unit.
  */
 function foldUnit(node: TaskNode): string {
-  return isGroupTask(node) && node.config.cache === undefined
-    ? `group|${[...node.deps].sort().join('|')}`
-    : `task|${node.id}`
+  if (!isGroupTask(node) || node.config.cache !== undefined) return `task|${node.id}`
+  const members = [...keyedDeps(node), ...(node.excludedUpstream ?? []).map((u) => u.node.id)]
+  return `group|${members.sort().join('|')}`
 }

package/src/orchestrator/logger.ts

@@ -19,11 +19,18 @@ import {
   type StatusStream,
   type WorkerSlot,
 } from './status-line.js'
-import { formatDuration, formatSummarySection, neverStarted, type RunContext } from './summary.js'
+import { formatSummarySection, neverStarted, type RunContext } from './summary.js'
 import { isGroupTask } from '../graph/index.js'
-import { appendTail, createTail, resetTail, tailText, type Tail } from '../util/index.js'
+import {
+  appendTail,
+  createTail,
+  formatElapsed,
+  resetTail,
+  tailText,
+  type Tail,
+} from '../util/index.js'
 import { isCacheHit } from './telemetry.js'
-import { failedLabel, outcomeWord } from './events.js'
+import { failedLabel, outcomeWord, ranNoCache } from './events.js'
 
 export interface Logger {
   /** Header / footer / status text. Written verbatim, one trailing \n added. */
@@ -139,8 +146,7 @@ function ghaFence(body: string, token: string): string {
   return `::stop-commands::${token}\n${body}::${token}::\n`
 }
 
-const cacheWordOf = (n: TaskNode): 'miss' | 'no-cache' =>
-  n.config.cache === undefined ? 'no-cache' : 'miss'
+const cacheWordOf = (o: TaskOutcome): 'miss' | 'no-cache' => (ranNoCache(o) ? 'no-cache' : 'miss')
 
 export function resolveOutputView(
   options: {
@@ -440,7 +446,7 @@ export function defaultLogger(
     (view.mode === 'focused' && isPrimary(node) && !isGroupTask(node) && requestedCount <= 1)
 
   const failureRow = (node: TaskNode, outcome: TaskOutcome): string =>
-    formatFailureLine(node.id, outcome.durationMs, colors, cacheWordOf(node)) +
+    formatFailureLine(node.id, outcome.durationMs, colors, cacheWordOf(outcome)) +
     flakyNote(outcome, colors)
 
   return {
@@ -453,6 +459,12 @@ export function defaultLogger(
       // A kept server's held partial line is older than this line: held
       // past it, a server's last words printed below its own exit notice.
       flushKept()
+      // A live-streamed server keeps writing after its frame closes, so a
+      // summary row or "exited with code" can follow its partial line.
+      if (streamMidLine) {
+        writer.write('\n')
+        streamMidLine = false
+      }
       writer.write(`${line}\n`)
     },
     runStart(info) {
@@ -654,7 +666,7 @@ export function defaultLogger(
         done++
         if (outcome.status === 'failed') {
           failed++
-          if (node.config.cache === undefined) noCache++
+          if (ranNoCache(outcome)) noCache++
         } else if (node.config.exec?.persistent !== undefined && outcome.status === 'success') {
           // A persistent task's outcome arrives at READY; the child
           // keeps running until the orchestrator SIGTERMs it at run
@@ -678,7 +690,7 @@ export function defaultLogger(
         switch (outcome.status) {
           case 'success':
             succeeded++
-            if (node.config.cache === undefined) noCache++
+            if (ranNoCache(outcome)) noCache++
             break
           case 'cache-hit':
             if (outcome.restored === false) upToDate++
@@ -875,7 +887,7 @@ export function defaultLogger(
             } else {
               emitBlock(
                 `::group::${ghaData(
-                  `${node.id} (${outcomeWord(outcome)} ${formatDuration(outcome.durationMs)})`,
+                  `${node.id} (${outcomeWord(outcome)} ${formatElapsed(outcome.durationMs)})`,
                 )}\n${body}::endgroup::\n`,
               )
             }

package/src/orchestrator/metrics.ts

@@ -407,11 +407,18 @@ function unchangedKeyNote(
       at: number
     } | null
   )?.at
-  // Both runs executed the task and succeeded with the cache writable, no
-  // entry holds the key, and each ran beside a failure: the continue-taint
-  // (admission.ts), which runs a task downstream of a failure and never
-  // saves it. Blaming `--no-cache` / `--force` named a flag nobody passed.
-  if (createdAt === undefined && this_.status === 'success' && prev.status === 'success') {
+  // The previous run executed the task and succeeded with the cache
+  // writable beside a failure, and no entry older than this run holds the
+  // key: the continue-taint (admission.ts), which runs a task downstream of
+  // a failure and never saves it. Blaming `--no-cache` / `--force` named a
+  // flag nobody passed, and a prune when this run saved the key named an
+  // eviction that never happened.
+  if (
+    (createdAt === undefined || createdAt >= this_.startedAt) &&
+    this_.status === 'success' &&
+    prev.status === 'success' &&
+    prev.cacheHit === 0
+  ) {
     const failedWithWrites = (id: string | null): number => {
       if (id === null) return 0
       const row = db
@@ -420,9 +427,13 @@ function unchangedKeyNote(
       const writes = row?.p.split(',').some((axis) => axis === 'lW' || axis === 'rW') === true
       return writes ? (row?.f ?? 0) : 0
     }
-    const now = failedWithWrites(runId)
-    if (prev.cacheHit === 0 && now > 0 && failedWithWrites(prev.runId) > 0) {
-      return `cache key unchanged — neither run saved it: each ran beside a failed task (${now} failed in this one), and a task run past a failed dependency (--continue) is never cached`
+    const before = failedWithWrites(prev.runId)
+    if (before > 0) {
+      const now = failedWithWrites(runId)
+      if (createdAt === undefined && now > 0) {
+        return `cache key unchanged — neither run saved it: each ran beside a failed task (${now} failed in this one), and a task run past a failed dependency (--continue) is never cached`
+      }
+      return `cache key unchanged — the previous run on this key ran beside a failed task (${before} failed in it) and was not saved: a task run past a failed dependency (--continue) is never cached, so there was nothing to hit`
     }
   }
   if (createdAt !== undefined && createdAt >= this_.startedAt) {