@vzn/vx 0.0.596 → 0.0.597

package/src/exec/sandbox-violations.ts

@@ -4,7 +4,7 @@
 // task's owner can act on — inside the project, minus the loopback denial
 // no grant can avoid, minus what the task chose to ignore.
 
-import { lstatSync, statSync } from 'node:fs'
+import { existsSync, lstatSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { absolutize, atOrUnder, isUnderAny, localBindingOn, toRealPath } from './sandbox-paths.js'
 import { bindableReads, bindableWrites } from './sandbox-binds.js'
@@ -364,6 +364,10 @@ export async function parseStraceViolations(
   // workspace, never reported.
   const pendingWrites = (args.config.pendingWrites ?? []).map((g) => new Bun.Glob(g))
   const denyAnchors = baselines.denyRead.map((p) => toRealPath(absolutize(p)))
+  const mounted = new Set([
+    ...allowAbs,
+    ...bindableWrites(args.config.allowWrite).map((p) => toRealPath(absolutize(p))),
+  ])
   // A read under a widened write grant's directory is never refused, so it
   // is reported when it succeeds: an entry that was there at the start and
   // no grant covers is an input the key never saw, and so is the
@@ -388,12 +392,14 @@ export async function parseStraceViolations(
     baselines.cwd,
     widened.size > 0,
   )) {
-    const abs = toRealPath(absolutize(rawPath, dir ?? baselines.cwd))
+    const lexical = absolutize(rawPath, dir ?? baselines.cwd)
+    const abs = toRealPath(lexical)
     // Only report paths under the workspace-root deny anchor — system
     // libs / /proc / /sys / etc. probes are not interesting violations.
     if (!denyAnchors.some((root) => atOrUnder(abs, root))) continue
     // Skip paths the user explicitly allowed (and their descendants).
-    if (isUnderAny(abs, allowAbs) || underGlob(abs, pendingWrites)) continue
+    if (isUnderAny(abs, allowAbs) && !hiddenByLink(lexical, abs, mounted, denyAnchors)) continue
+    if (underGlob(abs, pendingWrites)) continue
     if (read === true && !undeclared(abs)) continue
     // A hidden path answers ENOENT, as a missing one does: a probe
     // (`./gen.sh || …`, `test -x`, a PATH walk) is a refusal only where
@@ -427,6 +433,39 @@ export async function parseStraceViolations(
   return out
 }
 
+/**
+ * A granted file the task could not open because a link on the path it
+ * opened is not in the sandbox. A grant is mounted at its real path and
+ * bwrap mounts no link, so `read: ['config.json']` over `config.json ->
+ * conf/real.json` bound the target and left the name the task opens out;
+ * judged by its real path, the ENOENT was granted and dropped, and a tool
+ * that fell back on the missing file was cached green. The link is there
+ * when the directory holding it is mounted; a target missing on the host
+ * is missing outside the sandbox too, and outside the deny anchor the
+ * host is mounted, links and all.
+ */
+function hiddenByLink(
+  lexical: string,
+  real: string,
+  mounted: Set<string>,
+  anchors: readonly string[],
+): boolean {
+  if (lexical === real || !existsSync(real)) return false
+  let at = lexical
+  const links: string[] = []
+  for (let up = path.dirname(at); up !== at; at = up, up = path.dirname(at)) {
+    try {
+      if (lstatSync(at).isSymbolicLink()) links.push(at)
+    } catch {
+      // Not on the host by this spelling: no link to judge here.
+    }
+  }
+  return links.some((l) => {
+    const holder = toRealPath(path.dirname(l))
+    return anchors.some((a) => atOrUnder(holder, a)) && !isUnderAny(holder, mounted)
+  })
+}
+
 /**
  * Does a violation line match something the task said to ignore?
  *
@@ -444,9 +483,11 @@ function matchesIgnore(
   ignore: NonNullable<ResolvedSandboxConfig['ignore']>,
 ): boolean {
   if (v.target === undefined || v.ignorable === undefined) return false
+  const proxy = PROXY_DENY_RE.test(v.line)
   for (const which of v.ignorable) {
-    const patterns = ignore[which]
-    if (patterns === undefined) continue
+    const listed = ignore[which]
+    if (listed === undefined) continue
+    const patterns = proxy ? listed.map(hostKey) : listed
     const subject = which === 'read' || which === 'write' ? (v.path ?? v.target) : v.target
     if (patterns.some((pat) => pat === subject || new Bun.Glob(pat).match(subject))) return true
   }
@@ -460,7 +501,7 @@ function matchesIgnore(
  */
 function describeMacViolation(line: string): Partial<SandboxViolation> {
   const proxy = PROXY_DENY_RE.exec(line)
-  if (proxy !== null) return { target: proxy[1]!, ignorable: ['network'] }
+  if (proxy !== null) return { target: hostKey(proxy[1]!), ignorable: ['network'] }
   const m = /deny\(\d+\)\s+(\S+)\s+(.+?)\s*$/.exec(line)
   if (m === null) return {}
   const [op, target] = [m[1]!, m[2]!]
@@ -677,6 +718,18 @@ function filterIgnored(
  */
 const PROXY_DENY_RE = /^deny network-outbound (\S+) \([^)]*\)$/
 
+/**
+ * `<host>[:<port>]` as the proxy matches it: case-blind, no trailing dot.
+ * The record keeps the client's spelling (curl sends `EXAMPLE.Com`, curl
+ * and Bun keep `example.com.`), so an exact match against the ignore list
+ * left a refusal the task named in its report.
+ */
+function hostKey(target: string): string {
+  const colon = target.lastIndexOf(':')
+  const host = colon === -1 ? target : target.slice(0, colon)
+  return host.toLowerCase().replace(/\.$/, '') + (colon === -1 ? '' : target.slice(colon))
+}
+
 /**
  * Linux: the connections the proxy refused, from the store records. Only
  * the write observer's records were read there, so a task denied a host

package/src/graph/scheduler.ts

@@ -179,8 +179,8 @@ export interface TaskOutcome {
   /** The attempts that failed and were run again, in order: when each ended (epoch ms) and how. */
   failedAttempts?: readonly { endedAt: number; exitCode: number; timedOut?: true }[]
   /**
-   * Set when this run proved the task flaky: its key holds both outcomes on
-   * record (this run's included) or it needed a retry. Its row carries it.
+   * Set when this run proved the task flaky: its key failed after it had
+   * passed (this run's included) or it needed a retry. Its row carries it.
    */
   flaky?: { passes: number; failures: number }
   /**

package/src/graph/task-graph.ts

@@ -334,7 +334,8 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
 
   function add(node: TaskNode): void {
     nodes.set(node.id, node)
-    if ((node.config.dependsOn?.length ?? 0) > 0) {
+    if (isKeyedGroup(node.config) && onCycle(node.projectName)) deferred.push(node)
+    else if ((node.config.dependsOn?.length ?? 0) > 0) {
       stack.push({ node, entry: 0, added: false, pending: null, next: 0 })
     }
   }
@@ -444,10 +445,43 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
     }
     return component.get(start)!
   }
+  // Default builds on a package cycle, expanded once the rest is built.
+  const deferred: TaskNode[] = []
   const onCycle = (name: string): boolean => cyclic.has(componentOf(name))
   const sameCycle = (a: string, b: string): boolean =>
     onCycle(a) && componentOf(a) === componentOf(b)
 
+  // `^name` from `start`: edges to the nearest holders of `name` among the
+  // packages below it, passing through the ones `visited` holds and the
+  // ones that declare no `name`, and on past a default build on a cycle.
+  // True when it found a holder.
+  function walkHolders(frame: Frame, name: string, visited: Set<string>, start: string): boolean {
+    const frontier = [...packageGraph.directDeps(start)]
+    let held = false
+    while (frontier.length > 0) {
+      const target = frontier.pop()!
+      if (visited.has(target)) continue
+      visited.add(target)
+      if (visit(frame, target, name, false)) {
+        held = true
+        const task = declaredTask(projects.get(target)!.config, name)!
+        if (isKeyedGroup(task) && onCycle(target)) {
+          frontier.push(...packageGraph.directDeps(target))
+        }
+      } else frontier.push(...packageGraph.directDeps(target))
+    }
+    return held
+  }
+
+  // An edge by name (`build`, `pkg#build`) to a default build on a package
+  // cycle goes on past it as a `^build` walk does: that build folds nothing
+  // of the builds on its cycle, so `a#test` on `build` with `a` ↔ `b` both
+  // on the default build folded none of `b` and hit after `b` changed.
+  function goPast(frame: Frame, project: string, name: string, visited: Set<string>): void {
+    const task = declaredTask(projects.get(project)!.config, name)!
+    if (isKeyedGroup(task) && onCycle(project)) walkHolders(frame, name, visited, project)
+  }
+
   // Resolves one `dependsOn` entry of `frame`'s task into its edges.
   function resolveEntry(frame: Frame, raw: string): void {
     const { node } = frame
@@ -497,6 +531,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
             `Task ${id} depends on ${taskId(projectName, spec.task)} but no such task is declared`,
           )
         }
+        goPast(frame, projectName, spec.task, new Set([projectName]))
       }
     } else if (spec.kind === 'deps') {
       // Nearest-holder frontier (Turbo/Nx direct-deps parity +
@@ -521,45 +556,35 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
       // depend on itself.
       //
       // The default `build` sits on every project, so on a package cycle it
-      // would make a task cycle no config declares. Its own walk passes
-      // through the projects on its cycle (each of their builds reaches it),
-      // and a walk that meets it on a cycle takes the edge and goes on past
-      // it, so the builds it could not depend on still come first.
-      const re = isTaskPattern(spec.task) ? compileTaskPattern(spec.task) : null
-      const keyed = isKeyedGroup(node.config)
+      // would make a task cycle no config declares. One on a cycle walks
+      // last (`resolveDeferred`), and a walk that meets it on a cycle takes
+      // the edge and goes on past it, so the builds it could not depend on
+      // still come first.
       const visited = new Set<string>([projectName])
+      if (!isTaskPattern(spec.task)) {
+        const held = walkHolders(frame, spec.task, visited, projectName)
+        if (!held && !declaredAnywhere(projectName, spec.task)) {
+          if (undeclaredDeps === undefined) throw undeclaredDepsError(id, spec.task)
+          undeclaredDeps(id, spec.task)
+        }
+        return
+      }
+      // A pattern that matches nothing stays legal, as `build.*` does.
+      const re = compileTaskPattern(spec.task)
       const frontier = [...packageGraph.directDeps(projectName)]
-      let held = false
       while (frontier.length > 0) {
         const target = frontier.pop()!
         if (visited.has(target)) continue
         visited.add(target)
-        if (re === null) {
-          if (keyed && sameCycle(projectName, target)) {
-            frontier.push(...packageGraph.directDeps(target))
-          } else if (visit(frame, target, spec.task, false)) {
-            held = true
-            const task = declaredTask(projects.get(target)!.config, spec.task)!
-            if (isKeyedGroup(task) && onCycle(target)) {
-              frontier.push(...packageGraph.directDeps(target))
-            }
-          } else frontier.push(...packageGraph.directDeps(target))
+        const names = Object.keys(projects.get(target)?.config.tasks ?? {}).filter((n) =>
+          re.test(n),
+        )
+        if (names.length > 0) {
+          for (const name of names) visit(frame, target, name, false)
         } else {
-          const names = Object.keys(projects.get(target)?.config.tasks ?? {}).filter((n) =>
-            re.test(n),
-          )
-          if (names.length > 0) {
-            for (const name of names) visit(frame, target, name, false)
-          } else {
-            frontier.push(...packageGraph.directDeps(target))
-          }
+          frontier.push(...packageGraph.directDeps(target))
         }
       }
-      // A pattern that matches nothing stays legal, as `build.*` does.
-      if (re === null && !held && !declaredAnywhere(projectName, spec.task)) {
-        if (undeclaredDeps === undefined) throw undeclaredDepsError(id, spec.task)
-        undeclaredDeps(id, spec.task)
-      }
     } else {
       // Cross-project edge: pkg#task. Missing target is a hard error
       // because the user named the package + task explicitly.
@@ -573,11 +598,11 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
           `Task ${id} depends on ${taskId(spec.project, spec.task)} but no such project or task is declared`,
         )
       }
+      goPast(frame, spec.project, spec.task, new Set([projectName, spec.project]))
     }
   }
 
-  for (const { project, task } of requested) {
-    visit(null, project, task, true)
+  const drain = (): void => {
     while (stack.length > 0) {
       const frame = stack[stack.length - 1]!
       const { node, pending } = frame
@@ -604,10 +629,97 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
     }
   }
 
+  for (const { project, task } of requested) {
+    visit(null, project, task, true)
+    drain()
+  }
+
+  // A default build on a package cycle: its `^build` walk, run once the
+  // graph holds everything else. A build on its cycle that reaches it is
+  // passed through (an edge to it would close a task cycle no config
+  // declares); one that does not is a holder like any other, so the default
+  // build waits for it and folds its key. Passed through unasked, `p#test`
+  // on `p#build` ran beside a `t#build` on no `^build` and hit after `t`
+  // changed. A build no other edge brought is expanded to ask, and pruned
+  // again when it reaches back. Each walk sees the edges the ones before it
+  // took, so no edge closes a cycle.
+  let expanded = false
+  const resolveDeferred = (x: TaskNode): void => {
+    // The default build's one entry is `^` and its own name.
+    const name = x.taskName
+    const frame: Frame = { node: x, entry: 0, added: false, pending: null, next: 0 }
+    let reaching: Set<string> | null = null
+    const visited = new Set<string>([x.projectName])
+    const frontier = [...packageGraph.directDeps(x.projectName)]
+    while (frontier.length > 0) {
+      const target = frontier.pop()!
+      if (visited.has(target)) continue
+      visited.add(target)
+      const task = declaredTask(projects.get(target)?.config, name)
+      if (task === undefined) {
+        frontier.push(...packageGraph.directDeps(target))
+        continue
+      }
+      const to = taskId(target, name)
+      if (sameCycle(x.projectName, target)) {
+        if (!isKeyedGroup(task) && !nodes.has(to)) {
+          visit(null, target, name, false)
+          drain()
+          expanded = true
+          reaching = null
+        }
+        if (isKeyedGroup(task) || (reaching ??= reachingTo(nodes, x.id)).has(to)) {
+          frontier.push(...packageGraph.directDeps(target))
+          continue
+        }
+      }
+      const size = nodes.size
+      frame.added = false
+      visit(frame, target, name, false)
+      drain()
+      if (nodes.size !== size) reaching = null
+      if (isKeyedGroup(task) && onCycle(target)) frontier.push(...packageGraph.directDeps(target))
+    }
+    x.deps = [...new Set(x.deps)].sort()
+  }
+  for (let i = 0; i < deferred.length; i++) resolveDeferred(deferred[i]!)
+  if (expanded) {
+    const keep = new Set<string>()
+    const roots = [...nodes.values()].filter((n) => n.requested).map((n) => n.id)
+    while (roots.length > 0) {
+      const id = roots.pop()!
+      if (keep.has(id)) continue
+      keep.add(id)
+      roots.push(...nodes.get(id)!.deps)
+    }
+    for (const id of nodes.keys()) if (!keep.has(id)) nodes.delete(id)
+  }
+
   checkGraph(nodes, options.workspaceRoot, options.rules)
   return nodes
 }
 
+/** The ids of the tasks that reach `target` along `deps`, itself included. */
+function reachingTo(nodes: Map<string, TaskNode>, target: string): Set<string> {
+  const dependants = new Map<string, string[]>()
+  for (const n of nodes.values()) {
+    for (const d of n.deps) {
+      const list = dependants.get(d)
+      if (list === undefined) dependants.set(d, [n.id])
+      else list.push(n.id)
+    }
+  }
+  const out = new Set<string>()
+  const stack = [target]
+  while (stack.length > 0) {
+    const id = stack.pop()!
+    if (out.has(id)) continue
+    out.add(id)
+    stack.push(...(dependants.get(id) ?? []))
+  }
+  return out
+}
+
 /**
  * What a task graph must hold before it is scheduled: each node under its
  * own id, every dep a node, no cycle, and no two tasks deleting each

package/src/orchestrator/affected-tasks.ts

@@ -4,7 +4,7 @@
 // behind `^build` runs when `ui#build` (or what it depends on) is reached,
 // and a spec edit `ui#build`'s inputs leave out stops at `ui`'s own tasks.
 
-import { declaresInput } from '../cache/index.js'
+import { declaresInput, workspaceFilesReachInto } from '../cache/index.js'
 import {
   compileTaskPattern,
   isGroupTask,
@@ -91,7 +91,11 @@ export function affectedRoots(
     const cache = n.config.cache
     // Asked of every node, not only the changed projects' (the
     // `workspaceFiles` owners): a `graph` hook may have given the glob.
-    if (cache !== undefined && changes.changed.some((rel) => declaresInput(cache, null, rel))) {
+    if (
+      cache !== undefined &&
+      (changes.changed.some((rel) => declaresInput(cache, null, rel)) ||
+        (changes.nested ?? []).some((dir) => workspaceFilesReachInto(cache, dir)))
+    ) {
       return true
     }
     if (!changes.projects.has(n.projectName)) return false

package/src/orchestrator/deferred-outputs.ts

@@ -23,7 +23,8 @@ import type { TaskNode } from '../graph/index.js'
 export interface DeferredEntry {
   /** Fetches this task's outputs onto disk. At-most-once by construction. */
   materialize: () => Promise<void>
-  hash: string
+  /** The key a fetch saves the bytes under; absent when the inputs moved after it was taken. */
+  hash?: string
   entry: { taskId: string; command: string; durationMs: number; stdout: string }
 }
 
@@ -149,7 +150,7 @@ export class DeferredOutputs {
     // Convergence: an ordinary entry, so the next run is a plain local hit
     // and nothing downstream learns a second shape. Policy still governs —
     // a run that writes no local entries writes none here either.
-    if (this.args.localWrite) {
+    if (this.args.localWrite && entry.hash !== undefined) {
       await this.args.cache.save({
         hash: entry.hash,
         projectDir: producer.projectDir,

package/src/orchestrator/doctor.ts

@@ -97,7 +97,7 @@ export interface InfoFacts {
   hits24h: number
   /** Of `hits24h`, the hits that restored outputs; the rest were up to date. */
   restored24h: number
-  /** Tasks the retained history shows both passing and failing on unchanged inputs. */
+  /** Tasks the retained history shows failing on a key that had passed. */
   flakyTasks: FlakyTask[]
   lockfile: boolean
   /**
@@ -256,7 +256,7 @@ async function collectWorkspaceInfo(
     runs24h: stats.runCountLast24h,
     hits24h: stats.hitCountLast24h,
     restored24h: stats.restoredCountLast24h,
-    // Same inputs, both outcomes — the history's definition of flaky, over
+    // A key that failed after it had passed — the history's definition of flaky, over
     // the 30 days it keeps. A run names its own findings in its footer;
     // this is the workspace's standing list.
     flakyTasks: flaky,

package/src/orchestrator/excluded-keys.ts

@@ -16,7 +16,7 @@
 import type { CacheLayer, GitFilesCache } from '../cache/index.js'
 import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { computeGroupKey, computeTaskHash, type HashCache } from './task-hash.js'
-import { filterUpstreamHashes, keyedDeps } from './upstream.js'
+import { filterUpstreamHashes, keyedDeps, keyedOutcome } from './upstream.js'
 
 export interface KeyExcludedArgs {
   /** The scheduled graph, after `excludeDependencies`. */
@@ -50,7 +50,7 @@ export async function keyExcludedDependencies(args: KeyExcludedArgs): Promise<vo
   // (item 737). The keys still resolve concurrently.
   const keys = new Map<string, Promise<string | undefined>>()
   const outcomes = (ids: readonly string[]): Promise<TaskOutcome[]> =>
-    Promise.all(ids.map(async (id) => synthetic(nodeOf(id), await keys.get(id)!)))
+    Promise.all(ids.map(async (id) => keyedOutcome(nodeOf(id), await keys.get(id)!)))
   const derive = async (node: TaskNode): Promise<string | undefined> => {
     const upstream = await outcomes(fullDeps(node))
     return (isGroupTask(node) ? computeGroupKey : computeTaskHash)({
@@ -139,14 +139,3 @@ function foldsExcludedKey(node: TaskNode): boolean {
       .length > 0
   )
 }
-
-/** A dependency as a key reads it: only `node` and `hash` matter. */
-function synthetic(node: TaskNode, hash: string | undefined): TaskOutcome {
-  return {
-    node,
-    status: 'success',
-    exitCode: 0,
-    durationMs: 0,
-    ...(hash !== undefined ? { hash } : {}),
-  }
-}

package/src/orchestrator/execute-task.ts

@@ -524,11 +524,10 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // exited before ready keeps its own exit code rather than a made-up 1.
     // One the readiness timeout is killing reports the signal's, as an
     // ordinary timeout does (X-24).
+    // A readiness timeout rejects once the group is gone (runner.ts), so a
+    // server that ignored the TERM holds no port into the next `vx watch`
+    // cycle, and a second signal here would cut a one-shot handler short.
     const ready = err instanceof PersistentReadyError ? err : undefined
-    // The timer's SIGKILL is a grace away and the shell may die on the
-    // TERM first: a server that ignores it held its port past run() into
-    // the next `vx watch` cycle. Return once the group is gone.
-    if (ready?.reason === 'timeout') await terminateChildren(() => [spawn.child])
     return {
       node,
       status: 'failed',
@@ -637,7 +636,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // `signal` stops a plugin executor on the run's stop AND on
   // `exec.timeout`: core cannot kill a process an executor spawned, so a
   // declared timeout meant nothing on one that kept its own clock (H-12).
-  // The local executor keeps its own timer (it signals the process group).
+  // The local executor keeps its own timer from the spawn (it signals the
+  // process group), so its request carries no clock: armed here, it also
+  // timed the sandbox's wrap, and a wrap slower than the timeout aborted
+  // the request before the spawn — a task reported killed, never run.
   let timeoutTimer: ReturnType<typeof setTimeout> | undefined
   let timeoutFired = false
   // The attempt's listener on the run's stop signal, taken off once the
@@ -645,7 +647,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // grew to the task count, and each add scans it for a duplicate, ~100 ms
   // of a 1,000-task cold run.
   let unlistenStop: (() => void) | undefined
-  function requestSignal(): AbortSignal {
+  function requestSignal(local: boolean): AbortSignal {
     const stop = new AbortController()
     const abort = (): void => stop.abort(args.stopSignal?.reason)
     unlistenStop?.()
@@ -656,9 +658,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       run.addEventListener('abort', abort, { once: true })
       unlistenStop = () => run.removeEventListener('abort', abort)
     }
-    if (effectiveTimeout !== undefined) {
-      clearTimeout(timeoutTimer)
-      timeoutFired = false
+    clearTimeout(timeoutTimer)
+    timeoutFired = false
+    if (effectiveTimeout !== undefined && !local) {
       timeoutTimer = setTimeout(() => {
         timeoutFired = true
         stop.abort(new Error(`timed out after ${effectiveTimeout}ms`))
@@ -808,7 +810,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
     if (preProbed !== undefined) {
       if (preProbed.hit !== null) {
-        const restored = await restoreOrMiss(preProbed.hit)
+        // A key taken before a task rewrote the lockfile names an install
+        // the tree no longer holds, and the lazy path below never probes
+        // one (X-124): demoted like a vanished hit, it runs dep-gated.
+        const restored = fingerprintMoved() ? null : await restoreOrMiss(preProbed.hit)
         if (restored !== null) return restored
         // The up-front probe's hit may be restoring AHEAD of this task's
         // deps, and a command run now would build from outputs they have
@@ -917,6 +922,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   async function runAttempt(): Promise<{
     result: ExecuteResult
     exitCode: number
+    withdrawn?: true
   }> {
     // A deferred task's outputs are deliberately NOT coming, so wiping the
     // tree would replace a stale build with nothing at all. The eligibility
@@ -952,8 +958,18 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
     violations = []
     const endReq = span('miss: build request')
-    const req = await buildRequest()
+    const req = await buildRequest(isLocalExecutor(args.executor))
     endReq()
+    // A sibling's failure under --continue=never can land while a retry
+    // cleans or builds its request, after the loop's own check: the retry
+    // is withdrawn and the attempt before it stands.
+    if (attempt > 1 && args.failFast?.aborted === true) {
+      clearTimeout(timeoutTimer)
+      unlistenStop?.()
+      unlistenStop = undefined
+      await sweepPlaceholders(placeholders)
+      return { result, exitCode: effectiveExitCode, withdrawn: true }
+    }
     // An executor that THROWS produces no captured output. Rethrown: the
     // scheduler classifies it and prints its one line into the task's own
     // stream (run()'s onError), where the frame reads it; a copy written
@@ -984,8 +1000,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
             raw = new UserError(`${why}, and remote: 'only' keeps it off this machine`)
           } else {
             log.status(`[vx] ${node.id}: ${why} — running it here`)
-            clearTimeout(timeoutTimer)
-            const local = await localExecutor().execute(await buildRequest())
+            const local = await localExecutor().execute(await buildRequest(true))
             assertExecuteResult('local', node.id, local)
             return local
           }
@@ -1016,11 +1031,11 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         stdout: maskCaptured(res.stdout, secrets),
         stderr: maskCaptured(res.stderr, secrets),
       }
-    // An executor that stopped on the timeout's abort exits non-zero; say
-    // why, so the frame, the retry line and `timedOut` read as a timeout.
-    if (timeoutFired && res.exitCode !== 0 && res.timedOut !== true) {
-      res = { ...res, timedOut: true }
-    }
+    // An executor that stopped on the timeout's abort timed out, whatever
+    // its exit: a child that traps the TERM and exits 0 left partial outputs
+    // a pass would save (X-125), as the local runner's own `timedOut` says.
+    // A local request carries no timer, so the runner alone decides there.
+    if (timeoutFired && res.timedOut !== true) res = { ...res, timedOut: true }
     violations = [...res.violations]
     // A denial under a dependency the key does not answer for says only
     // ENOENT; the line beside it names the package and how to key it. Only
@@ -1167,10 +1182,15 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   for (;;) {
     attempt++
     const a = await runAttempt()
-    forgetUndeclaredWrites(args, writeReach)
-    if (writesFingerprint) args.fingerprintWatch?.wrote()
     result = a.result
     effectiveExitCode = a.exitCode
+    if (a.withdrawn) {
+      attempt--
+      failedAttempts.pop()
+      break
+    }
+    forgetUndeclaredWrites(args, writeReach)
+    if (writesFingerprint) args.fingerprintWatch?.wrote()
     spentMs += result.durationMs
 
     // An attempt that ended in a shutdown never finished on its own terms —
@@ -1219,7 +1239,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
   }
 
-  async function buildRequest(): Promise<ExecuteRequest> {
+  async function buildRequest(local: boolean): Promise<ExecuteRequest> {
     const out = secrets && maskedEmitter(secrets, (t) => log.taskStdout(node, t))
     const err = secrets && maskedEmitter(secrets, (t) => log.taskStderr(node, t))
     flushMasked = () => {
@@ -1257,10 +1277,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       outputs: { files: outputs, workspaceFiles: wsOutputs },
       ...(args.terminal === true ? { terminal: true as const } : {}),
     }
-    // The signal last: it arms `exec.timeout`, and the sandbox's arming
+    // The signal last: it arms a plugin's `exec.timeout`, and the sandbox's arming
     // below is vx's work, not the task's. Armed first, a 60 ms timeout
     // expired before the spawn and failed `echo` as timed out, unrun.
-    if (!userSandbox) return { ...base, signal: requestSignal() }
+    if (!userSandbox) return { ...base, signal: requestSignal(local) }
     await args.armSandbox?.()
     const sb = await sandboxRequestFor(
       node,
@@ -1272,7 +1292,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
     placeholders = sb.placeholders
     withheld = sb.withheld
-    return { ...base, sandbox: sb.sandbox, signal: requestSignal() }
+    return { ...base, sandbox: sb.sandbox, signal: requestSignal(local) }
   }
 
   const wallclockEndNs = process.hrtime.bigint() - args.runStartHrTimeNs
@@ -1283,12 +1303,15 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // record (a row with no artifact) is exactly the corrupt-entry shape
     // `restoreOutputs` refuses, so writing none is the only clean answer.
     // The closure is what a later local consumer — or a later eager run —
-    // pulls the bytes with.
+    // pulls the bytes with. Its fetch saves them under `hash` only past the
+    // eager save's check: an input edited before the describe filed the
+    // edit's bytes under the old key (X-123).
     const materialize = result.outputs?.kind === 'deferred' ? result.outputs.materialize : undefined
     if (materialize !== undefined) {
+      const keyed = await keyStillTrue()
       args.deferred?.register(node.id, {
         materialize,
-        hash,
+        ...(keyed ? { hash } : {}),
         entry: {
           taskId: node.id,
           command: storedCommand,