@vzn/vx 0.0.596 → 0.0.597

package/src/orchestrator/failure-mode.ts

@@ -21,34 +21,40 @@ export type FailureMode = 'stable' | 'flaky-recoverable' | 'flaky-fatal'
 
 /**
  * Per-key outcome projection: every keyed (project, task, hash) under
- * `source` (a relation with `project`, `task`, `hash`, `status`, `cache_hit`
- * columns) with how often it failed and how often it passed — a pass being
- * an executed success or a cache hit, which replays a success. Every
+ * `source` (`runs`, or a relation with its `id`, `project`, `task`, `hash`,
+ * `status`, `cache_hit` columns) with how often it failed, how often it
+ * passed — an executed success or a cache hit, which replays a success —
+ * and how often it failed AFTER its first pass (`relapses`). Every
  * flakiness reader is a filter over this one projection.
  */
 function keyOutcomesSql(source: string, where = ''): string {
-  return `SELECT project, task, hash,
-       SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failures,
-       SUM(CASE WHEN status = 'success' AND attempts > 1 THEN attempts - 1 ELSE 0 END)
-         AS retried_failures,
-       SUM(CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
-           THEN 1 ELSE 0 END) AS passes
-       FROM ${source}
-       WHERE ${KEYED_RUNS_SQL}${where}
+  return `SELECT project, task, hash, SUM(failed) AS failures, SUM(passed) AS passes,
+       SUM(retried) AS retried_failures,
+       SUM(CASE WHEN failed = 1 AND id > first_pass THEN 1 ELSE 0 END) AS relapses
+       FROM (SELECT project, task, hash, id, failed, passed, retried,
+           MIN(CASE WHEN passed = 1 THEN id END) OVER (PARTITION BY project, task, hash) AS first_pass
+         FROM (SELECT project, task, hash, id,
+             CASE WHEN status = 'failed' THEN 1 ELSE 0 END AS failed,
+             CASE WHEN status = 'success' AND attempts > 1 THEN attempts - 1 ELSE 0 END AS retried,
+             CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
+               THEN 1 ELSE 0 END AS passed
+           FROM ${source}
+           WHERE ${KEYED_RUNS_SQL}${where}))
        GROUP BY project, task, hash`
 }
 
 /**
  * Per-key outcome subquery: the distinct cache keys under `source` that
- * produced BOTH a failure and a success — the definitional flake: identical
- * inputs, different outcomes. A failure whose key never succeeded is a
- * legitimate break (a changed input that fails), which belongs to the
- * regressions surface, not flakiness. One projection of the rule serves the
+ * FAILED AFTER THEY HAD PASSED — the definitional flake: identical inputs,
+ * a green result, then a red one. A failure whose key never succeeded is a
+ * legitimate break (a changed input that fails), and failures that end in
+ * a first pass are a recovery (a missing tool installed, a service brought
+ * up): neither is flakiness. One projection of the rule serves the
  * all-time query below and the windowed one in `history.ts`.
  */
 export function mixedOutcomeKeysSql(source: string, where = ''): string {
   return `SELECT project, task FROM (${keyOutcomesSql(source, where)})
-       WHERE failures > 0 AND passes > 0`
+       WHERE relapses > 0`
 }
 
 /** Mixed-outcome keys of one (project, task) over its WHOLE recorded history. */
@@ -63,7 +69,7 @@ export function mixedOutcomeKeyCount(db: Database, project: string, task: string
 
 /**
  * The verdict. Flaky requires a NONDETERMINISM signal: a within-run retry,
- * or a cache key that both failed and succeeded (`mixedKeys`). Failures
+ * or a cache key that failed after it had passed (`mixedKeys`). Failures
  * alone — each on its own key — are legitimate breaks, however many there
  * are. `mixedKeys` is a thunk so a task that never failed is stable without
  * the key count being computed at all.
@@ -120,9 +126,9 @@ const keyOf = (c: { project: string; task: string; hash: string }): string =>
 
 /**
  * Which of this run's executed tasks are flaky, judged BEFORE the run's own
- * rows are recorded: a pass on a key that has failed before, a failure on
- * a key that has passed before, or a within-run retry. The counts fold this
- * run in.
+ * rows are recorded: a failure on a key that has passed before, a pass on a
+ * key that already did so, or a within-run retry. A first pass after only
+ * failures is a recovery, not a flake. The counts fold this run in.
  *
  * The cost follows the run's colour. No candidate (every task a hit or a
  * skip): no query. A green miss: one probe of the `runs_failed` partial
@@ -148,7 +154,7 @@ export function detectFlaky(db: Database, candidates: readonly FlakyCandidate[])
     (c) => c.status === 'failed' || c.attempts > 1 || everFailed.has(keyOf(c)),
   )
   if (suspects.length === 0) return []
-  const counts = new Map<string, { passes: number; failures: number }>()
+  const counts = new Map<string, { passes: number; failures: number; relapses: number }>()
   chunked(suspects, (chunk) => {
     const rows = db
       .query(keyOutcomesSql('runs', ` AND hash IN (${chunk.map(() => '?').join(', ')})`))
@@ -158,27 +164,30 @@ export function detectFlaky(db: Database, candidates: readonly FlakyCandidate[])
       hash: string
       passes: number
       failures: number
+      relapses: number
     }[]
-    for (const r of rows) counts.set(keyOf(r), { passes: r.passes, failures: r.failures })
+    for (const r of rows)
+      counts.set(keyOf(r), { passes: r.passes, failures: r.failures, relapses: r.relapses })
   })
   const out: FlakyFinding[] = []
   for (const c of suspects) {
-    const before = counts.get(keyOf(c)) ?? { passes: 0, failures: 0 }
+    const before = counts.get(keyOf(c)) ?? { passes: 0, failures: 0, relapses: 0 }
+    const relapsed = c.status === 'failed' ? before.passes > 0 : before.relapses > 0
+    if (!relapsed && c.attempts <= 1) continue
     const passes = before.passes + (c.status === 'success' ? 1 : 0)
     const failures = before.failures + (c.status === 'failed' ? 1 : 0)
-    if (!(passes > 0 && failures > 0) && c.attempts <= 1) continue
     out.push({ ...c, taskId: `${c.project}#${c.task}`, passes, failures })
   }
   return out
 }
 
-/** One task the recorded history shows both passing and failing on unchanged inputs. */
+/** One task the recorded history shows failing on a key that had passed. */
 export interface FlakyTask {
   /** `project#task`. */
   taskId: string
   project: string
   task: string
-  /** Distinct cache keys that both passed and failed. */
+  /** Distinct cache keys that failed after they had passed. */
   keys: number
   /** Outcomes over those keys. */
   passes: number
@@ -186,7 +195,7 @@ export interface FlakyTask {
 }
 
 /**
- * Every task with a mixed-outcome key anywhere in the retained history
+ * Every task with a key that failed after it had passed anywhere in the retained history
  * (30 days, `RunHistory.pruneOlderThan`), most failures first: the
  * doctor's list. A pass that took a retry mixes its key on its own: it is
  * one `success` row whose failed attempts count as failures (`vx info`
@@ -198,8 +207,8 @@ export function flakyTasks(db: Database): FlakyTask[] {
     .query(
       `SELECT project, task, COUNT(*) AS keys, SUM(passes) AS passes, SUM(failures) AS failures
        FROM (SELECT project, task, passes, failures + retried_failures AS failures
-             FROM (${keyOutcomesSql('runs')}))
-       WHERE failures > 0 AND passes > 0
+             FROM (${keyOutcomesSql('runs')})
+             WHERE relapses > 0 OR retried_failures > 0)
        GROUP BY project, task
        ORDER BY failures DESC, passes DESC, project, task`,
     )

package/src/orchestrator/framed-output.ts

@@ -27,9 +27,9 @@
 
 import { withForwardArgs } from '../exec/index.js'
 import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
-import { maskedCommand } from '../util/index.js'
+import { formatElapsed, maskedCommand } from '../util/index.js'
 import { paint, type ColorSupport } from './colors.js'
-import { formatDuration, neverStarted } from './summary.js'
+import { neverStarted } from './summary.js'
 import { outcomeLabel, ranNoCache, skippedReason } from './events.js'
 
 const NO_COLOR: ColorSupport = { enabled: false }
@@ -220,7 +220,7 @@ const CACHE_COL = 8 // "no-cache" / "remote" / "local" / "fresh" / "miss"
 
 /** Right-align the duration in a TIME_COL cell (pad on the left). */
 function timeCell(ms: number | null, colors: ColorSupport): string {
-  const raw = ms === null ? '' : formatDuration(ms)
+  const raw = ms === null ? '' : formatElapsed(ms)
   return ' '.repeat(Math.max(0, TIME_COL - raw.length)) + paint('', raw, colors, { dim: true })
 }
 
@@ -487,7 +487,7 @@ export function formatFrameClose(
   // both ends of the frame as a long-lived task.
   const tail =
     persistent && outcome.status === 'success'
-      ? ` ${paint('', `(${formatDuration(outcome.durationMs)})`, colors, { dim: true })} ${paint(ACCENT, 'running', colors)}`
+      ? ` ${paint('', `(${formatElapsed(outcome.durationMs)})`, colors, { dim: true })} ${paint(ACCENT, 'running', colors)}`
       : formatBlockFooter(outcome, colors)
   const close = `${corner('└─')} ${mark}${paintTaskId(node, colors, { bold: true })} ${corner('──')}${tail}`
   const violations = violationSection(outcome, colors)
@@ -594,7 +594,7 @@ function formatBlockFooter(o: TaskOutcome, colors: ColorSupport): string {
   // saved" on the strength of it. The stored time lives on
   // `TaskOutcome.storedDurationMs`.) Status differs by outcome — see
   // formatStatusTag.
-  const dur = paint('', `(${formatDuration(o.durationMs)})`, colors, { dim: true })
+  const dur = paint('', `(${formatElapsed(o.durationMs)})`, colors, { dim: true })
   const tag = formatStatusTag(o, colors)
   return ` ${dur} ${tag}${flakyNote(o, colors)}`
 }

package/src/orchestrator/index.ts

@@ -30,7 +30,6 @@ export { defaultLogger, resolveOutputView } from './logger.js'
 export { detectColors, paint, type ColorSupport } from './colors.js'
 export type { Logger, OutputView } from './logger.js'
 export type { RunPlan, PlannedTask, PlanPrediction, CacheStatus } from './plan.js'
-export { formatDuration } from './summary.js'
 export {
   createEventBus,
   wireForwarder,

package/src/orchestrator/keyed-projects.ts

@@ -93,9 +93,12 @@ export function foldedDeps(node: TaskNode, nodeOf: (id: string) => TaskNode): Fo
  * the hashes are. An exec task's key folds its own id (`task:<id>`), so its
  * id is enough; a group's hash is a roll-up of its members' ids and hashes
  * with no id of its own, so two groups over the same members hash alike.
+ * The members are `keyUpstream`'s, which `computeGroupHash` is handed: under
+ * `--exclude-dependencies` `node.deps` holds order-only edges and lacks the
+ * dropped ones, and two groups the key told apart shared a unit.
  */
 function foldUnit(node: TaskNode): string {
-  return isGroupTask(node) && node.config.cache === undefined
-    ? `group|${[...node.deps].sort().join('|')}`
-    : `task|${node.id}`
+  if (!isGroupTask(node) || node.config.cache !== undefined) return `task|${node.id}`
+  const members = [...keyedDeps(node), ...(node.excludedUpstream ?? []).map((u) => u.node.id)]
+  return `group|${members.sort().join('|')}`
 }

package/src/orchestrator/logger.ts

@@ -19,9 +19,16 @@ import {
   type StatusStream,
   type WorkerSlot,
 } from './status-line.js'
-import { formatDuration, formatSummarySection, neverStarted, type RunContext } from './summary.js'
+import { formatSummarySection, neverStarted, type RunContext } from './summary.js'
 import { isGroupTask } from '../graph/index.js'
-import { appendTail, createTail, resetTail, tailText, type Tail } from '../util/index.js'
+import {
+  appendTail,
+  createTail,
+  formatElapsed,
+  resetTail,
+  tailText,
+  type Tail,
+} from '../util/index.js'
 import { isCacheHit } from './telemetry.js'
 import { failedLabel, outcomeWord, ranNoCache } from './events.js'
 
@@ -880,7 +887,7 @@ export function defaultLogger(
             } else {
               emitBlock(
                 `::group::${ghaData(
-                  `${node.id} (${outcomeWord(outcome)} ${formatDuration(outcome.durationMs)})`,
+                  `${node.id} (${outcomeWord(outcome)} ${formatElapsed(outcome.durationMs)})`,
                 )}\n${body}::endgroup::\n`,
               )
             }

package/src/orchestrator/miss-save.ts

@@ -148,11 +148,9 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
     // `cache.outputs` is not a write grant; `exec.sandbox.allow.write` is.
     const sandboxed = node.config.exec?.sandbox !== undefined
     const grantsWrite = (node.config.exec?.sandbox?.allow?.write?.length ?? 0) > 0
-    // The workspace side too: a `workspaceFiles` directory linked out of
-    // the workspace drops every file the same way (M-65).
-    const linkedOut =
-      outputDirLinkedOut(node.projectDir, a.outputs, 'the project') ??
-      outputDirLinkedOut(a.workspaceRoot, a.wsOutputs, 'the workspace')
+    // A `workspaceFiles` directory linked out of the workspace drops every
+    // file (M-65); a project one is refused by the resolver (X-88).
+    const linkedOut = outputDirLinkedOut(a.workspaceRoot, a.wsOutputs)
     log.status(
       `[vx] ${node.id}: cache.outputs matched no files (${[...a.outputs, ...a.wsOutputs].join(', ')}) — ` +
         `an empty artifact is saved; a later hit restores nothing` +
@@ -300,15 +298,13 @@ function markWritten(
 }
 
 /**
- * The first output directory a pattern names that is a symlink resolving
- * outside `baseDir` (the project, or the workspace root for
- * `workspaceFiles`): every file under it is dropped as outside, and the
- * empty-artifact warning blamed the glob (M-61, M-65).
+ * The first `workspaceFiles` directory that is a symlink resolving outside
+ * the workspace root: every file under it is dropped as outside, and the
+ * empty-artifact warning blamed the glob (M-65).
  */
 function outputDirLinkedOut(
   baseDir: string,
   outputs: readonly string[],
-  base: string,
 ): { dir: string; target: string; base: string } | undefined {
   const realProject = realpathOrNull(baseDir) ?? baseDir
   // `dist` names the tree `dist/**`: the same reading the resolver gives.
@@ -326,7 +322,7 @@ function outputDirLinkedOut(
       }
       const target = realpathOrNull(abs)
       if (target !== null && target !== realProject && !target.startsWith(realProject + path.sep)) {
-        return { dir, target, base }
+        return { dir, target, base: 'the workspace' }
       }
     }
   }

package/src/orchestrator/plan.ts

@@ -14,16 +14,10 @@
 import type { CacheLayer, CachePolicy, GitFilesCache } from '../cache/index.js'
 import { cachesNothing, FULL_CACHE_POLICY } from '../cache/index.js'
 import { ranNoCache } from './events.js'
-import {
-  idleServers,
-  isGroupTask,
-  runGraph,
-  type TaskNode,
-  type TaskOutcome,
-} from '../graph/index.js'
+import { idleServers, isGroupTask, runGraph, type TaskNode } from '../graph/index.js'
 import type { HistoryProvider } from './history.js'
 import { computeGroupKey, computeTaskHash } from './task-hash.js'
-import { keyUpstream } from './upstream.js'
+import { keyedOutcome, keyUpstream } from './upstream.js'
 
 export type CacheStatus =
   | 'hit-local' // entry exists in local cache
@@ -157,7 +151,7 @@ export async function plan(args: PlanArgs): Promise<RunPlan> {
       }
       if (isGroupTask(node)) {
         cacheStatusById.set(node.id, 'group')
-        return planOutcome(node, await computeGroupKey(hashArgs))
+        return keyedOutcome(node, await computeGroupKey(hashArgs))
       }
 
       const hash = await computeTaskHash(hashArgs)
@@ -180,7 +174,7 @@ export async function plan(args: PlanArgs): Promise<RunPlan> {
         status = where === null ? 'miss' : where === 'remote' ? 'hit-remote' : 'hit-local'
       }
       cacheStatusById.set(node.id, status)
-      return planOutcome(node, hash)
+      return keyedOutcome(node, hash)
     },
   })
 
@@ -303,13 +297,3 @@ function predictPlan(tasks: PlannedTask[]): PlanPrediction {
   }
   return { wallMs, workMs, unknownCount }
 }
-
-function planOutcome(node: TaskNode, hash: string | undefined): TaskOutcome {
-  return {
-    node,
-    status: 'success',
-    exitCode: 0,
-    durationMs: 0,
-    ...(hash !== undefined ? { hash } : {}),
-  }
-}

package/src/orchestrator/run-artifacts.ts

@@ -94,8 +94,8 @@ function taskEntry(o: TaskOutcome, flaky?: FlakyFinding): SummaryTaskJson {
     // task that could never hit (its `hash` is still set — dependents fold
     // it). Present only when true, so every other row is byte-identical.
     ...(ranNoCache(o) ? { noCache: true } : {}),
-    // Present only when the run proved the task flaky: this exact key has
-    // both passed and failed on record (this run counted), or the task
+    // Present only when the run proved the task flaky: this exact key
+    // failed after it had passed (this run counted), or the task
     // needed a retry. A consumer gating on `failed` can tell a break from a
     // flake without the history; every other row is byte-identical.
     ...(flaky !== undefined

package/src/orchestrator/run-lock.ts

@@ -43,7 +43,8 @@
 // waited for itself forever (nx#36473 reproduced on vx, 2026-09-24). So a
 // lock naming OUR pid is stale unless this process placed that entry and
 // has not left it (`placed`) — and on Linux the entry also carries the holder's start
-// time, so a pid another process now wears is stale too. Where the lock
+// time, so a pid another process now wears is stale too, and so is a
+// holder procfs shows as a zombie (killed, not yet reaped). Where the lock
 // cannot be made or read for any reason but "held" (a temp directory this
 // user cannot write), the run says so once and proceeds unlocked: the
 // lock is a courtesy between cooperating runs, and refusing to run would
@@ -183,7 +184,7 @@ function ownLockRoot(lockDir: string): void {
 
 interface Holder {
   pid: number
-  /** The holder's start time as `startTime` read it; null where the lock names none. */
+  /** The holder's start time as `procStat` read it; null where the lock names none. */
   start: string | null
   /** The entry in the lock directory that names it. */
   entry: string
@@ -223,17 +224,18 @@ async function holder(lockDir: string): Promise<Holder | 'free' | null> {
 }
 
 /**
- * When a process started, in clock ticks since boot: field 22 of
- * `/proc/<pid>/stat`. Two processes that wore one pid differ here. Null
- * off Linux, where the answer costs a `ps` spawn per run, under a procfs
- * mounted for another pid namespace, and for a pid procfs does not show.
+ * `/proc/<pid>/stat` from field 3 on: the state first, and at [19] field
+ * 22, the start time in clock ticks since boot, where two processes that
+ * wore one pid differ. Null off Linux, where the answer costs a `ps`
+ * spawn, under a procfs mounted for another pid namespace, and for a pid
+ * procfs does not show.
  */
-function startTime(pid: number | 'self'): string | null {
+function procStat(pid: number | 'self'): string[] | null {
   if (!procfsIsOwn()) return null
   try {
     const stat = readFileSync(`/proc/${pid}/stat`, 'utf8')
     // Fields after the LAST ')' start at field 3; comm may hold spaces.
-    return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19] ?? null
+    return stat.slice(stat.lastIndexOf(')') + 2).split(' ')
   } catch {
     return null
   }
@@ -244,21 +246,24 @@ let ownId: string | undefined
 /** Tells this process's takings of a lock apart, and their staging names. */
 let takings = 0
 function nextEntry(): string {
-  ownId ??= `h-${process.pid}-${startTime('self') ?? 'x'}`
+  ownId ??= `h-${process.pid}-${procStat('self')?.[19] ?? 'x'}`
   return `${ownId}-${++takings}`
 }
 
 /**
- * Is the lock's holder a live run of another process? `sameAsLast`: this
- * holder's start time already matched on an earlier poll, so a wait reads
- * procfs once per holder, not once per poll.
+ * Is the lock's holder a live run of another process? Read on every poll:
+ * a holder killed whose parent does not reap it (a container's pid 1 that
+ * never waits) is a zombie, which signal 0 still reaches and whose start
+ * time still matches, and a wait that trusted either waited for it until
+ * the reaper came, or for good.
  */
-function holderLive(h: Holder, sameAsLast: boolean): boolean {
+function holderLive(h: Holder): boolean {
   if (h.pid === process.pid) return placed.has(h.entry)
   if (!alive(h.pid)) return false
-  if (h.start === null || sameAsLast) return true
-  const now = startTime(h.pid)
-  return now === null || now === h.start
+  const stat = procStat(h.pid)
+  if (stat === null) return true
+  if (stat[0] === 'Z' || stat[0] === 'X') return false
+  return h.start === null || stat[19] === h.start
 }
 
 function alive(pid: number): boolean {
@@ -326,7 +331,6 @@ export async function acquireRunLock(
   const lockDir = runLockPath(workspaceRoot, opts.dir)
   const started = Date.now()
   let said = false
-  let lastLive: Holder | undefined
   const release = async (): Promise<void> => {
     const left = (heldHere.get(lockDir) ?? 1) - 1
     if (left > 0) {
@@ -377,7 +381,7 @@ export async function acquireRunLock(
           await rm(lockDir, { recursive: true, force: true })
           continue
         }
-      } else if (!holderLive(h, lastLive?.entry === h.entry && lastLive.start === h.start)) {
+      } else if (!holderLive(h)) {
         if (h.entry === LEGACY_PID) await rm(lockDir, { recursive: true, force: true })
         else await leave(lockDir, h.entry)
         continue
@@ -391,12 +395,9 @@ export async function acquireRunLock(
       )
       return async () => {}
     }
-    if (h !== null) {
-      lastLive = h
-      if (!said && Date.now() - started >= SAY_AFTER_MS) {
-        said = true
-        opts.log(`[vx] waiting for another vx run (pid ${h.pid}) on this workspace to finish…`)
-      }
+    if (h !== null && !said && Date.now() - started >= SAY_AFTER_MS) {
+      said = true
+      opts.log(`[vx] waiting for another vx run (pid ${h.pid}) on this workspace to finish…`)
     }
     await Bun.sleep(POLL_MS)
   }

package/src/orchestrator/run.ts

@@ -631,6 +631,7 @@ async function runOnBus(
       stopRun.abort(signal)
     },
     done: runLeft,
+    handsTerminal: holders.size > 0,
     // The grace, then one flush and each teardown at their own bound, and
     // slack for the summary and the cache close.
     boundMs:
@@ -1762,7 +1763,7 @@ function flakyCandidates(outcomes: readonly TaskOutcome[]): FlakyCandidate[] {
   const out: FlakyCandidate[] = []
   for (const o of outcomes) {
     if (o.status !== 'success' && o.status !== 'failed') continue
-    // "Same inputs, different outcome" is a claim only a task with declared
+    // "Same inputs, failed after passing" is a claim only a task with declared
     // inputs can make: a task with no `cache` block keys on its config alone
     // and runs every time, so one bad network day would read as a flake for
     // thirty days. Groups do no work.

package/src/orchestrator/sandbox-request.ts

@@ -326,8 +326,11 @@ export interface WithheldLink {
  * task is granted and what it is not.
  *
  * One level deep, plus one level inside a `@scope/` directory — the shape
- * a package manager writes. Anything already inside a granted directory
- * is dropped; what is left is a sibling project's real path.
+ * a package manager writes — and then the same in the `node_modules` of
+ * each granted target, so a dependency's own workspace dependencies are
+ * reached as the runtime reaches them. A target inside the granted
+ * `node_modules` or inside the package holding the link is dropped; what
+ * is left is a sibling project's real path.
  *
  * A link to the task's OWN project, or to a directory holding it, is
  * dropped too: npm and Yarn classic link every workspace package at the
@@ -371,20 +374,39 @@ async function linkedDeps(
     }
     return found
   }
+  const keyedDirs =
+    keyed === undefined ? undefined : new Set(await Promise.all([...keyed].map((d) => realpath(d))))
+  const grants = (target: string): boolean =>
+    keyedDirs === undefined || !atOrUnder(target, root) || keyedDirs.has(target)
   // Merged in `dirs` order, so the link a hint names is the project's own
-  // when both have one.
+  // when both have one. A granted package is scanned in turn: pnpm and
+  // Bun link a dependency's own workspace dependencies only under ITS
+  // `node_modules`, so `app -> ui -> core` left core hidden and the import
+  // of ui failed with ENOENT, unreported.
   const targets = new Map<string, { link: string; name: string }>()
-  for (const found of await Promise.all(dirs.map((d) => scan(d, '')))) {
-    for (const [target, link, name] of found) {
-      if (!targets.has(target)) targets.set(target, { link, name })
+  let frontier: Array<[nodeModules: string, owner: string | undefined]> = dirs.map((d) => [
+    d,
+    undefined,
+  ])
+  while (frontier.length > 0) {
+    const next: typeof frontier = []
+    const scans = await Promise.all(frontier.map(([d]) => scan(d, '')))
+    for (const [i, found] of scans.entries()) {
+      const owner = frontier[i]![1]
+      for (const [target, link, name] of found) {
+        if (targets.has(target) || (owner !== undefined && atOrUnder(target, owner))) continue
+        targets.set(target, { link, name })
+        if (grants(target)) {
+          next.push([path.join(target, 'node_modules'), target])
+        }
+      }
     }
+    frontier = next
   }
-  if (keyed === undefined) return { granted: [...targets.keys()], withheld: [] }
-  const keyedDirs = new Set(await Promise.all([...keyed].map((d) => realpath(d))))
   const granted: string[] = []
   const withheld: WithheldLink[] = []
   for (const [target, { link, name }] of targets) {
-    if (!atOrUnder(target, root) || keyedDirs.has(target)) granted.push(target)
+    if (grants(target)) granted.push(target)
     else
       withheld.push({
         dir: target,

package/src/orchestrator/signals.ts

@@ -2,8 +2,8 @@
 // — the scheduler dispatches nothing more, and the signal is forwarded to
 // everything live, SIGKILLed after a bounded grace — then waits, bounded,
 // for run() to leave its own end-of-run path (telemetry flush, each
-// plugin's teardown, the cache close), and exits 128+signo (130/143). A
-// second signal exits at once. Without the forward, a
+// plugin's teardown, the cache close), and dies of the signal (130/143 to
+// its parent). A second signal does so at once. Without the forward, a
 // programmatic signal to the vx process alone (CI cancellation,
 // `kill <pid>`) orphans every running child — terminal Ctrl-C only worked
 // via process-group propagation. Without the escalation (added
@@ -14,7 +14,7 @@
 // them to the runner around every spawn.
 
 import { signalExitCode } from '../exec/index.js'
-import { claimExitForSignal, killGraceMs, settleWithin } from '../util/index.js'
+import { claimExitForSignal, hangupIgnored, killGraceMs, settleWithin } from '../util/index.js'
 import { holdGroups, killTree, untilGroupsGone } from '../exec/index.js'
 import type { Logger } from './logger.js'
 
@@ -111,6 +111,13 @@ export function forwardSignals(args: {
   done: Promise<void>
   /** How long a signal waits for `done` before it exits anyway. */
   boundMs: number
+  /**
+   * A task may be handed the terminal (`exec.interactive` on a TTY) and may
+   * leave it raw or without echo. Bun puts back the terminal it started
+   * with when it exits, not when a signal kills it, so this run exits with
+   * the signal's code rather than dying of the signal.
+   */
+  handsTerminal?: boolean
   /** In-flight children; the runner adds and removes each around its spawn. */
   liveChildren: ReadonlySet<Child>
   /** Ready persistent tasks the orchestrator owns until the graph finishes. */
@@ -124,6 +131,16 @@ export function forwardSignals(args: {
     } catch {
       // double-close race with the normal path; we're exiting anyway
     }
+    // Die of the signal once the exit hooks have run: a shell running vx
+    // in a script stops it on Ctrl-C only when its child died of SIGINT,
+    // and a 130 exit ran the script's next line. The code stays the
+    // fallback should the signal not land.
+    if (args.handsTerminal !== true) {
+      process.once('exit', () => {
+        process.removeAllListeners(signal)
+        process.kill(process.pid, signal)
+      })
+    }
     process.exit(signalExitCode(signal))
   }
   let stopping: StopSignal | undefined
@@ -158,7 +175,8 @@ export function forwardSignals(args: {
   if (args.enabled) {
     process.on('SIGINT', onSigint)
     process.on('SIGTERM', onSigterm)
-    process.on('SIGHUP', onSighup)
+    // A hang-up vx was started deaf to (nohup) stays ignored.
+    if (!hangupIgnored()) process.on('SIGHUP', onSighup)
   }
   return {
     remove: () => {

package/src/orchestrator/stable-keys.ts

@@ -17,7 +17,7 @@ import { isLiteralPattern, normalizeGlob, relPosix } from '../util/index.js'
 import { commandWriteReach, mayWriteFingerprint, undeclaredWriteReach } from './sandbox-request.js'
 import { foldedDeps } from './keyed-projects.js'
 import { computeGroupKey, computeTaskHash, type HashCache } from './task-hash.js'
-import { filterUpstreamHashes, keyUpstream } from './upstream.js'
+import { filterUpstreamHashes, keyedOutcome, keyUpstream } from './upstream.js'
 
 export interface DeriveStableKeysArgs {
   nodes: Map<string, TaskNode>
@@ -382,9 +382,7 @@ function foldedBy(
 }
 
 /**
- * Synthetic upstream outcomes for key derivation. Only `node` + `hash`
- * are read by filterUpstreamHashes / computeGroupHash; the rest of
- * TaskOutcome is irrelevant here, so we cast a minimal shape.
+ * Synthetic upstream outcomes for key derivation (`keyedOutcome`).
  */
 function synthUpstream(
   node: TaskNode,
@@ -395,13 +393,7 @@ function synthUpstream(
   for (const dep of node.deps) {
     const depNode = nodes.get(dep)
     if (!depNode) continue
-    out.push({
-      node: depNode,
-      status: 'success',
-      exitCode: 0,
-      durationMs: 0,
-      hash: keyById.get(dep),
-    } as TaskOutcome)
+    out.push(keyedOutcome(depNode, keyById.get(dep)))
   }
   return keyUpstream(node, out)
 }