@vzn/vx 0.0.596 → 0.0.598

package/src/graph/task-graph.ts

@@ -334,7 +334,8 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
 
   function add(node: TaskNode): void {
     nodes.set(node.id, node)
-    if ((node.config.dependsOn?.length ?? 0) > 0) {
+    if (isKeyedGroup(node.config) && onCycle(node.projectName)) deferred.push(node)
+    else if ((node.config.dependsOn?.length ?? 0) > 0) {
       stack.push({ node, entry: 0, added: false, pending: null, next: 0 })
     }
   }
@@ -444,10 +445,43 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
     }
     return component.get(start)!
   }
+  // Default builds on a package cycle, expanded once the rest is built.
+  const deferred: TaskNode[] = []
   const onCycle = (name: string): boolean => cyclic.has(componentOf(name))
   const sameCycle = (a: string, b: string): boolean =>
     onCycle(a) && componentOf(a) === componentOf(b)
 
+  // `^name` from `start`: edges to the nearest holders of `name` among the
+  // packages below it, passing through the ones `visited` holds and the
+  // ones that declare no `name`, and on past a default build on a cycle.
+  // True when it found a holder.
+  function walkHolders(frame: Frame, name: string, visited: Set<string>, start: string): boolean {
+    const frontier = [...packageGraph.directDeps(start)]
+    let held = false
+    while (frontier.length > 0) {
+      const target = frontier.pop()!
+      if (visited.has(target)) continue
+      visited.add(target)
+      if (visit(frame, target, name, false)) {
+        held = true
+        const task = declaredTask(projects.get(target)!.config, name)!
+        if (isKeyedGroup(task) && onCycle(target)) {
+          frontier.push(...packageGraph.directDeps(target))
+        }
+      } else frontier.push(...packageGraph.directDeps(target))
+    }
+    return held
+  }
+
+  // An edge by name (`build`, `pkg#build`) to a default build on a package
+  // cycle goes on past it as a `^build` walk does: that build folds nothing
+  // of the builds on its cycle, so `a#test` on `build` with `a` ↔ `b` both
+  // on the default build folded none of `b` and hit after `b` changed.
+  function goPast(frame: Frame, project: string, name: string, visited: Set<string>): void {
+    const task = declaredTask(projects.get(project)!.config, name)!
+    if (isKeyedGroup(task) && onCycle(project)) walkHolders(frame, name, visited, project)
+  }
+
   // Resolves one `dependsOn` entry of `frame`'s task into its edges.
   function resolveEntry(frame: Frame, raw: string): void {
     const { node } = frame
@@ -497,6 +531,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
             `Task ${id} depends on ${taskId(projectName, spec.task)} but no such task is declared`,
           )
         }
+        goPast(frame, projectName, spec.task, new Set([projectName]))
       }
     } else if (spec.kind === 'deps') {
       // Nearest-holder frontier (Turbo/Nx direct-deps parity +
@@ -521,45 +556,35 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
       // depend on itself.
       //
       // The default `build` sits on every project, so on a package cycle it
-      // would make a task cycle no config declares. Its own walk passes
-      // through the projects on its cycle (each of their builds reaches it),
-      // and a walk that meets it on a cycle takes the edge and goes on past
-      // it, so the builds it could not depend on still come first.
-      const re = isTaskPattern(spec.task) ? compileTaskPattern(spec.task) : null
-      const keyed = isKeyedGroup(node.config)
+      // would make a task cycle no config declares. One on a cycle walks
+      // last (`resolveDeferred`), and a walk that meets it on a cycle takes
+      // the edge and goes on past it, so the builds it could not depend on
+      // still come first.
       const visited = new Set<string>([projectName])
+      if (!isTaskPattern(spec.task)) {
+        const held = walkHolders(frame, spec.task, visited, projectName)
+        if (!held && !declaredAnywhere(projectName, spec.task)) {
+          if (undeclaredDeps === undefined) throw undeclaredDepsError(id, spec.task)
+          undeclaredDeps(id, spec.task)
+        }
+        return
+      }
+      // A pattern that matches nothing stays legal, as `build.*` does.
+      const re = compileTaskPattern(spec.task)
       const frontier = [...packageGraph.directDeps(projectName)]
-      let held = false
       while (frontier.length > 0) {
         const target = frontier.pop()!
         if (visited.has(target)) continue
         visited.add(target)
-        if (re === null) {
-          if (keyed && sameCycle(projectName, target)) {
-            frontier.push(...packageGraph.directDeps(target))
-          } else if (visit(frame, target, spec.task, false)) {
-            held = true
-            const task = declaredTask(projects.get(target)!.config, spec.task)!
-            if (isKeyedGroup(task) && onCycle(target)) {
-              frontier.push(...packageGraph.directDeps(target))
-            }
-          } else frontier.push(...packageGraph.directDeps(target))
+        const names = Object.keys(projects.get(target)?.config.tasks ?? {}).filter((n) =>
+          re.test(n),
+        )
+        if (names.length > 0) {
+          for (const name of names) visit(frame, target, name, false)
         } else {
-          const names = Object.keys(projects.get(target)?.config.tasks ?? {}).filter((n) =>
-            re.test(n),
-          )
-          if (names.length > 0) {
-            for (const name of names) visit(frame, target, name, false)
-          } else {
-            frontier.push(...packageGraph.directDeps(target))
-          }
+          frontier.push(...packageGraph.directDeps(target))
         }
       }
-      // A pattern that matches nothing stays legal, as `build.*` does.
-      if (re === null && !held && !declaredAnywhere(projectName, spec.task)) {
-        if (undeclaredDeps === undefined) throw undeclaredDepsError(id, spec.task)
-        undeclaredDeps(id, spec.task)
-      }
     } else {
       // Cross-project edge: pkg#task. Missing target is a hard error
       // because the user named the package + task explicitly.
@@ -573,11 +598,11 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
           `Task ${id} depends on ${taskId(spec.project, spec.task)} but no such project or task is declared`,
         )
       }
+      goPast(frame, spec.project, spec.task, new Set([projectName, spec.project]))
     }
   }
 
-  for (const { project, task } of requested) {
-    visit(null, project, task, true)
+  const drain = (): void => {
     while (stack.length > 0) {
       const frame = stack[stack.length - 1]!
       const { node, pending } = frame
@@ -604,10 +629,97 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
     }
   }
 
+  for (const { project, task } of requested) {
+    visit(null, project, task, true)
+    drain()
+  }
+
+  // A default build on a package cycle: its `^build` walk, run once the
+  // graph holds everything else. A build on its cycle that reaches it is
+  // passed through (an edge to it would close a task cycle no config
+  // declares); one that does not is a holder like any other, so the default
+  // build waits for it and folds its key. Passed through unasked, `p#test`
+  // on `p#build` ran beside a `t#build` on no `^build` and hit after `t`
+  // changed. A build no other edge brought is expanded to ask, and pruned
+  // again when it reaches back. Each walk sees the edges the ones before it
+  // took, so no edge closes a cycle.
+  let expanded = false
+  const resolveDeferred = (x: TaskNode): void => {
+    // The default build's one entry is `^` and its own name.
+    const name = x.taskName
+    const frame: Frame = { node: x, entry: 0, added: false, pending: null, next: 0 }
+    let reaching: Set<string> | null = null
+    const visited = new Set<string>([x.projectName])
+    const frontier = [...packageGraph.directDeps(x.projectName)]
+    while (frontier.length > 0) {
+      const target = frontier.pop()!
+      if (visited.has(target)) continue
+      visited.add(target)
+      const task = declaredTask(projects.get(target)?.config, name)
+      if (task === undefined) {
+        frontier.push(...packageGraph.directDeps(target))
+        continue
+      }
+      const to = taskId(target, name)
+      if (sameCycle(x.projectName, target)) {
+        if (!isKeyedGroup(task) && !nodes.has(to)) {
+          visit(null, target, name, false)
+          drain()
+          expanded = true
+          reaching = null
+        }
+        if (isKeyedGroup(task) || (reaching ??= reachingTo(nodes, x.id)).has(to)) {
+          frontier.push(...packageGraph.directDeps(target))
+          continue
+        }
+      }
+      const size = nodes.size
+      frame.added = false
+      visit(frame, target, name, false)
+      drain()
+      if (nodes.size !== size) reaching = null
+      if (isKeyedGroup(task) && onCycle(target)) frontier.push(...packageGraph.directDeps(target))
+    }
+    x.deps = [...new Set(x.deps)].sort()
+  }
+  for (let i = 0; i < deferred.length; i++) resolveDeferred(deferred[i]!)
+  if (expanded) {
+    const keep = new Set<string>()
+    const roots = [...nodes.values()].filter((n) => n.requested).map((n) => n.id)
+    while (roots.length > 0) {
+      const id = roots.pop()!
+      if (keep.has(id)) continue
+      keep.add(id)
+      roots.push(...nodes.get(id)!.deps)
+    }
+    for (const id of nodes.keys()) if (!keep.has(id)) nodes.delete(id)
+  }
+
   checkGraph(nodes, options.workspaceRoot, options.rules)
   return nodes
 }
 
+/** The ids of the tasks that reach `target` along `deps`, itself included. */
+function reachingTo(nodes: Map<string, TaskNode>, target: string): Set<string> {
+  const dependants = new Map<string, string[]>()
+  for (const n of nodes.values()) {
+    for (const d of n.deps) {
+      const list = dependants.get(d)
+      if (list === undefined) dependants.set(d, [n.id])
+      else list.push(n.id)
+    }
+  }
+  const out = new Set<string>()
+  const stack = [target]
+  while (stack.length > 0) {
+    const id = stack.pop()!
+    if (out.has(id)) continue
+    out.add(id)
+    stack.push(...(dependants.get(id) ?? []))
+  }
+  return out
+}
+
 /**
  * What a task graph must hold before it is scheduled: each node under its
  * own id, every dep a node, no cycle, and no two tasks deleting each

package/src/index.ts

@@ -34,7 +34,9 @@ export { isLiteralPattern, normalizeGlob } from './util/index.js'
 // A task's command as vx prints it: values of its `exec.env.secret` names
 // masked. `vx show` and telemetry show this; a plugin that hands a command
 // to someone else (`@vzn/vx-mcp`'s `listTasks`, an AI agent) does too (L-26).
-export { maskedCommand } from './util/index.js'
+// `maskedLine` is the same for a line no one task owns: the error `vx mcp`
+// hands an agent (L-11).
+export { maskedCommand, maskedLine } from './util/index.js'
 
 // Schema types and helpers (used by user vx.config files and presets).
 export type {

package/src/orchestrator/affected-tasks.ts

@@ -4,7 +4,7 @@
 // behind `^build` runs when `ui#build` (or what it depends on) is reached,
 // and a spec edit `ui#build`'s inputs leave out stops at `ui`'s own tasks.
 
-import { declaresInput } from '../cache/index.js'
+import { declaresInput, workspaceFilesReachInto } from '../cache/index.js'
 import {
   compileTaskPattern,
   isGroupTask,
@@ -91,7 +91,11 @@ export function affectedRoots(
     const cache = n.config.cache
     // Asked of every node, not only the changed projects' (the
     // `workspaceFiles` owners): a `graph` hook may have given the glob.
-    if (cache !== undefined && changes.changed.some((rel) => declaresInput(cache, null, rel))) {
+    if (
+      cache !== undefined &&
+      (changes.changed.some((rel) => declaresInput(cache, null, rel)) ||
+        (changes.nested ?? []).some((dir) => workspaceFilesReachInto(cache, dir)))
+    ) {
       return true
     }
     if (!changes.projects.has(n.projectName)) return false

package/src/orchestrator/deferred-outputs.ts

@@ -23,7 +23,8 @@ import type { TaskNode } from '../graph/index.js'
 export interface DeferredEntry {
   /** Fetches this task's outputs onto disk. At-most-once by construction. */
   materialize: () => Promise<void>
-  hash: string
+  /** The key a fetch saves the bytes under; absent when the inputs moved after it was taken. */
+  hash?: string
   entry: { taskId: string; command: string; durationMs: number; stdout: string }
 }
 
@@ -149,7 +150,7 @@ export class DeferredOutputs {
     // Convergence: an ordinary entry, so the next run is a plain local hit
     // and nothing downstream learns a second shape. Policy still governs —
     // a run that writes no local entries writes none here either.
-    if (this.args.localWrite) {
+    if (this.args.localWrite && entry.hash !== undefined) {
       await this.args.cache.save({
         hash: entry.hash,
         projectDir: producer.projectDir,

package/src/orchestrator/doctor.ts

@@ -16,6 +16,7 @@ import {
   isUnsupportedBun,
   machineMemoryBytes,
   machineParallelism,
+  maskedLine,
   relPosix,
 } from '../util/index.js'
 import { VERSION } from '../version.js'
@@ -97,7 +98,7 @@ export interface InfoFacts {
   hits24h: number
   /** Of `hits24h`, the hits that restored outputs; the rest were up to date. */
   restored24h: number
-  /** Tasks the retained history shows both passing and failing on unchanged inputs. */
+  /** Tasks the retained history shows failing on a key that had passed. */
   flakyTasks: FlakyTask[]
   lockfile: boolean
   /**
@@ -256,7 +257,7 @@ async function collectWorkspaceInfo(
     runs24h: stats.runCountLast24h,
     hits24h: stats.hitCountLast24h,
     restored24h: stats.restoredCountLast24h,
-    // Same inputs, both outcomes — the history's definition of flaky, over
+    // A key that failed after it had passed — the history's definition of flaky, over
     // the 30 days it keeps. A run names its own findings in its footer;
     // this is the workspace's standing list.
     flakyTasks: flaky,
@@ -397,7 +398,8 @@ async function countLoadableTasks(
           : raw
         errors.push({
           path: relPosix(root, where),
-          message,
+          // A config's own throw is its author's text, a secret too (L-11).
+          message: maskedLine(message),
         })
       }
     }),

package/src/orchestrator/excluded-keys.ts

@@ -16,7 +16,7 @@
 import type { CacheLayer, GitFilesCache } from '../cache/index.js'
 import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { computeGroupKey, computeTaskHash, type HashCache } from './task-hash.js'
-import { filterUpstreamHashes, keyedDeps } from './upstream.js'
+import { filterUpstreamHashes, keyedDeps, keyedOutcome } from './upstream.js'
 
 export interface KeyExcludedArgs {
   /** The scheduled graph, after `excludeDependencies`. */
@@ -50,7 +50,7 @@ export async function keyExcludedDependencies(args: KeyExcludedArgs): Promise<vo
   // (item 737). The keys still resolve concurrently.
   const keys = new Map<string, Promise<string | undefined>>()
   const outcomes = (ids: readonly string[]): Promise<TaskOutcome[]> =>
-    Promise.all(ids.map(async (id) => synthetic(nodeOf(id), await keys.get(id)!)))
+    Promise.all(ids.map(async (id) => keyedOutcome(nodeOf(id), await keys.get(id)!)))
   const derive = async (node: TaskNode): Promise<string | undefined> => {
     const upstream = await outcomes(fullDeps(node))
     return (isGroupTask(node) ? computeGroupKey : computeTaskHash)({
@@ -139,14 +139,3 @@ function foldsExcludedKey(node: TaskNode): boolean {
       .length > 0
   )
 }
-
-/** A dependency as a key reads it: only `node` and `hash` matter. */
-function synthetic(node: TaskNode, hash: string | undefined): TaskOutcome {
-  return {
-    node,
-    status: 'success',
-    exitCode: 0,
-    durationMs: 0,
-    ...(hash !== undefined ? { hash } : {}),
-  }
-}

package/src/orchestrator/execute-task.ts

@@ -462,7 +462,7 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
           const after = noticeMs < 1000 ? `${noticeMs} ms` : `${noticeMs / 1000} s`
           const unbounded = effectiveTimeout === undefined ? ', with no exec.timeout' : ''
           log.status(
-            `vx: ${node.id} not ready after ${after}: waiting for a line matching /${readyWhen}/ (readyWhen)${unbounded}`,
+            `vx: ${node.id} not ready after ${after}: waiting for a line matching /${serverSecrets?.mask(readyWhen) ?? readyWhen}/ (readyWhen)${unbounded}`,
           )
         }, noticeMs)
   if (notice !== undefined) {
@@ -524,11 +524,10 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // exited before ready keeps its own exit code rather than a made-up 1.
     // One the readiness timeout is killing reports the signal's, as an
     // ordinary timeout does (X-24).
+    // A readiness timeout rejects once the group is gone (runner.ts), so a
+    // server that ignored the TERM holds no port into the next `vx watch`
+    // cycle, and a second signal here would cut a one-shot handler short.
     const ready = err instanceof PersistentReadyError ? err : undefined
-    // The timer's SIGKILL is a grace away and the shell may die on the
-    // TERM first: a server that ignores it held its port past run() into
-    // the next `vx watch` cycle. Return once the group is gone.
-    if (ready?.reason === 'timeout') await terminateChildren(() => [spawn.child])
     return {
       node,
       status: 'failed',
@@ -637,7 +636,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // `signal` stops a plugin executor on the run's stop AND on
   // `exec.timeout`: core cannot kill a process an executor spawned, so a
   // declared timeout meant nothing on one that kept its own clock (H-12).
-  // The local executor keeps its own timer (it signals the process group).
+  // The local executor keeps its own timer from the spawn (it signals the
+  // process group), so its request carries no clock: armed here, it also
+  // timed the sandbox's wrap, and a wrap slower than the timeout aborted
+  // the request before the spawn — a task reported killed, never run.
   let timeoutTimer: ReturnType<typeof setTimeout> | undefined
   let timeoutFired = false
   // The attempt's listener on the run's stop signal, taken off once the
@@ -645,7 +647,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // grew to the task count, and each add scans it for a duplicate, ~100 ms
   // of a 1,000-task cold run.
   let unlistenStop: (() => void) | undefined
-  function requestSignal(): AbortSignal {
+  function requestSignal(local: boolean): AbortSignal {
     const stop = new AbortController()
     const abort = (): void => stop.abort(args.stopSignal?.reason)
     unlistenStop?.()
@@ -656,9 +658,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       run.addEventListener('abort', abort, { once: true })
       unlistenStop = () => run.removeEventListener('abort', abort)
     }
-    if (effectiveTimeout !== undefined) {
-      clearTimeout(timeoutTimer)
-      timeoutFired = false
+    clearTimeout(timeoutTimer)
+    timeoutFired = false
+    if (effectiveTimeout !== undefined && !local) {
       timeoutTimer = setTimeout(() => {
         timeoutFired = true
         stop.abort(new Error(`timed out after ${effectiveTimeout}ms`))
@@ -808,7 +810,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
     if (preProbed !== undefined) {
       if (preProbed.hit !== null) {
-        const restored = await restoreOrMiss(preProbed.hit)
+        // A key taken before a task rewrote the lockfile names an install
+        // the tree no longer holds, and the lazy path below never probes
+        // one (X-124): demoted like a vanished hit, it runs dep-gated.
+        const restored = fingerprintMoved() ? null : await restoreOrMiss(preProbed.hit)
         if (restored !== null) return restored
         // The up-front probe's hit may be restoring AHEAD of this task's
         // deps, and a command run now would build from outputs they have
@@ -862,6 +867,24 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     for (const c of captured)
       if (c.kind === 'env' && named.includes(c.name) && !secretNamed(c.name))
         c.hash = MASKED + c.hash
+  // A runtime probe's row is named by its command, which a TS config may
+  // build from `process.env`: the run history stored it and `vx why`
+  // printed it (L-11).
+  const nameSecrets =
+    captured.length > 0 ? secretMask([process.env, env, step.env?.define], step.env?.secret) : null
+  if (nameSecrets !== null) {
+    // Two probes that differ only by a secret mask to one name, and a row
+    // is stored once per name: numbered, the second's change still shows.
+    const seen = new Set(captured.map((c) => `${c.kind}\0${c.name}`))
+    for (const c of captured) {
+      const masked = nameSecrets.mask(c.name)
+      if (masked === c.name) continue
+      let name = masked
+      for (let n = 2; seen.has(`${c.kind}\0${name}`); n++) name = `${masked} (${n})`
+      seen.add(`${c.kind}\0${name}`)
+      c.name = name
+    }
+  }
   const inputs: TaskInputs | undefined = described?.inputs
   const inputChanges = described !== undefined ? args.explainMiss?.(node.id, captured) : undefined
   // A plugin may keep the request past the run (the cache closed): it gets
@@ -917,6 +940,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   async function runAttempt(): Promise<{
     result: ExecuteResult
     exitCode: number
+    withdrawn?: true
   }> {
     // A deferred task's outputs are deliberately NOT coming, so wiping the
     // tree would replace a stale build with nothing at all. The eligibility
@@ -952,8 +976,18 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
     violations = []
     const endReq = span('miss: build request')
-    const req = await buildRequest()
+    const req = await buildRequest(isLocalExecutor(args.executor))
     endReq()
+    // A sibling's failure under --continue=never can land while a retry
+    // cleans or builds its request, after the loop's own check: the retry
+    // is withdrawn and the attempt before it stands.
+    if (attempt > 1 && args.failFast?.aborted === true) {
+      clearTimeout(timeoutTimer)
+      unlistenStop?.()
+      unlistenStop = undefined
+      await sweepPlaceholders(placeholders)
+      return { result, exitCode: effectiveExitCode, withdrawn: true }
+    }
     // An executor that THROWS produces no captured output. Rethrown: the
     // scheduler classifies it and prints its one line into the task's own
     // stream (run()'s onError), where the frame reads it; a copy written
@@ -984,8 +1018,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
             raw = new UserError(`${why}, and remote: 'only' keeps it off this machine`)
           } else {
             log.status(`[vx] ${node.id}: ${why} — running it here`)
-            clearTimeout(timeoutTimer)
-            const local = await localExecutor().execute(await buildRequest())
+            const local = await localExecutor().execute(await buildRequest(true))
             assertExecuteResult('local', node.id, local)
             return local
           }
@@ -1016,11 +1049,11 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         stdout: maskCaptured(res.stdout, secrets),
         stderr: maskCaptured(res.stderr, secrets),
       }
-    // An executor that stopped on the timeout's abort exits non-zero; say
-    // why, so the frame, the retry line and `timedOut` read as a timeout.
-    if (timeoutFired && res.exitCode !== 0 && res.timedOut !== true) {
-      res = { ...res, timedOut: true }
-    }
+    // An executor that stopped on the timeout's abort timed out, whatever
+    // its exit: a child that traps the TERM and exits 0 left partial outputs
+    // a pass would save (X-125), as the local runner's own `timedOut` says.
+    // A local request carries no timer, so the runner alone decides there.
+    if (timeoutFired && res.timedOut !== true) res = { ...res, timedOut: true }
     violations = [...res.violations]
     // A denial under a dependency the key does not answer for says only
     // ENOENT; the line beside it names the package and how to key it. Only
@@ -1167,10 +1200,15 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   for (;;) {
     attempt++
     const a = await runAttempt()
-    forgetUndeclaredWrites(args, writeReach)
-    if (writesFingerprint) args.fingerprintWatch?.wrote()
     result = a.result
     effectiveExitCode = a.exitCode
+    if (a.withdrawn) {
+      attempt--
+      failedAttempts.pop()
+      break
+    }
+    forgetUndeclaredWrites(args, writeReach)
+    if (writesFingerprint) args.fingerprintWatch?.wrote()
     spentMs += result.durationMs
 
     // An attempt that ended in a shutdown never finished on its own terms —
@@ -1219,7 +1257,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
   }
 
-  async function buildRequest(): Promise<ExecuteRequest> {
+  async function buildRequest(local: boolean): Promise<ExecuteRequest> {
     const out = secrets && maskedEmitter(secrets, (t) => log.taskStdout(node, t))
     const err = secrets && maskedEmitter(secrets, (t) => log.taskStderr(node, t))
     flushMasked = () => {
@@ -1257,10 +1295,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       outputs: { files: outputs, workspaceFiles: wsOutputs },
       ...(args.terminal === true ? { terminal: true as const } : {}),
     }
-    // The signal last: it arms `exec.timeout`, and the sandbox's arming
+    // The signal last: it arms a plugin's `exec.timeout`, and the sandbox's arming
     // below is vx's work, not the task's. Armed first, a 60 ms timeout
     // expired before the spawn and failed `echo` as timed out, unrun.
-    if (!userSandbox) return { ...base, signal: requestSignal() }
+    if (!userSandbox) return { ...base, signal: requestSignal(local) }
     await args.armSandbox?.()
     const sb = await sandboxRequestFor(
       node,
@@ -1272,7 +1310,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     )
     placeholders = sb.placeholders
     withheld = sb.withheld
-    return { ...base, sandbox: sb.sandbox, signal: requestSignal() }
+    return { ...base, sandbox: sb.sandbox, signal: requestSignal(local) }
   }
 
   const wallclockEndNs = process.hrtime.bigint() - args.runStartHrTimeNs
@@ -1283,12 +1321,15 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // record (a row with no artifact) is exactly the corrupt-entry shape
     // `restoreOutputs` refuses, so writing none is the only clean answer.
     // The closure is what a later local consumer — or a later eager run —
-    // pulls the bytes with.
+    // pulls the bytes with. Its fetch saves them under `hash` only past the
+    // eager save's check: an input edited before the describe filed the
+    // edit's bytes under the old key (X-123).
     const materialize = result.outputs?.kind === 'deferred' ? result.outputs.materialize : undefined
     if (materialize !== undefined) {
+      const keyed = await keyStillTrue()
       args.deferred?.register(node.id, {
         materialize,
-        hash,
+        ...(keyed ? { hash } : {}),
         entry: {
           taskId: node.id,
           command: storedCommand,
@@ -1470,7 +1511,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       ? {
           // vx's own notes ride with the lines and are no denial (B-20).
           sandboxViolations: finalViolations.filter((v) => v.hint !== true).length,
-          sandboxViolationLines: finalViolations.map((v) => v.line),
+          // A denied path is the task's own spelling, a secret in it too.
+          sandboxViolationLines: finalViolations.map((v) => secrets?.mask(v.line) ?? v.line),
         }
       : {}),
   }