@vzn/vx 0.0.596 → 0.0.598

package/src/orchestrator/failure-mode.ts

@@ -21,34 +21,40 @@ export type FailureMode = 'stable' | 'flaky-recoverable' | 'flaky-fatal'
 
 /**
  * Per-key outcome projection: every keyed (project, task, hash) under
- * `source` (a relation with `project`, `task`, `hash`, `status`, `cache_hit`
- * columns) with how often it failed and how often it passed — a pass being
- * an executed success or a cache hit, which replays a success. Every
+ * `source` (`runs`, or a relation with its `id`, `project`, `task`, `hash`,
+ * `status`, `cache_hit` columns) with how often it failed, how often it
+ * passed — an executed success or a cache hit, which replays a success —
+ * and how often it failed AFTER its first pass (`relapses`). Every
  * flakiness reader is a filter over this one projection.
  */
 function keyOutcomesSql(source: string, where = ''): string {
-  return `SELECT project, task, hash,
-       SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failures,
-       SUM(CASE WHEN status = 'success' AND attempts > 1 THEN attempts - 1 ELSE 0 END)
-         AS retried_failures,
-       SUM(CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
-           THEN 1 ELSE 0 END) AS passes
-       FROM ${source}
-       WHERE ${KEYED_RUNS_SQL}${where}
+  return `SELECT project, task, hash, SUM(failed) AS failures, SUM(passed) AS passes,
+       SUM(retried) AS retried_failures,
+       SUM(CASE WHEN failed = 1 AND id > first_pass THEN 1 ELSE 0 END) AS relapses
+       FROM (SELECT project, task, hash, id, failed, passed, retried,
+           MIN(CASE WHEN passed = 1 THEN id END) OVER (PARTITION BY project, task, hash) AS first_pass
+         FROM (SELECT project, task, hash, id,
+             CASE WHEN status = 'failed' THEN 1 ELSE 0 END AS failed,
+             CASE WHEN status = 'success' AND attempts > 1 THEN attempts - 1 ELSE 0 END AS retried,
+             CASE WHEN status = 'success' OR status IN ${HIT_STATUSES} OR cache_hit = 1
+               THEN 1 ELSE 0 END AS passed
+           FROM ${source}
+           WHERE ${KEYED_RUNS_SQL}${where}))
        GROUP BY project, task, hash`
 }
 
 /**
  * Per-key outcome subquery: the distinct cache keys under `source` that
- * produced BOTH a failure and a success — the definitional flake: identical
- * inputs, different outcomes. A failure whose key never succeeded is a
- * legitimate break (a changed input that fails), which belongs to the
- * regressions surface, not flakiness. One projection of the rule serves the
+ * FAILED AFTER THEY HAD PASSED — the definitional flake: identical inputs,
+ * a green result, then a red one. A failure whose key never succeeded is a
+ * legitimate break (a changed input that fails), and failures that end in
+ * a first pass are a recovery (a missing tool installed, a service brought
+ * up): neither is flakiness. One projection of the rule serves the
  * all-time query below and the windowed one in `history.ts`.
  */
 export function mixedOutcomeKeysSql(source: string, where = ''): string {
   return `SELECT project, task FROM (${keyOutcomesSql(source, where)})
-       WHERE failures > 0 AND passes > 0`
+       WHERE relapses > 0`
 }
 
 /** Mixed-outcome keys of one (project, task) over its WHOLE recorded history. */
@@ -63,7 +69,7 @@ export function mixedOutcomeKeyCount(db: Database, project: string, task: string
 
 /**
  * The verdict. Flaky requires a NONDETERMINISM signal: a within-run retry,
- * or a cache key that both failed and succeeded (`mixedKeys`). Failures
+ * or a cache key that failed after it had passed (`mixedKeys`). Failures
  * alone — each on its own key — are legitimate breaks, however many there
  * are. `mixedKeys` is a thunk so a task that never failed is stable without
  * the key count being computed at all.
@@ -120,9 +126,9 @@ const keyOf = (c: { project: string; task: string; hash: string }): string =>
 
 /**
  * Which of this run's executed tasks are flaky, judged BEFORE the run's own
- * rows are recorded: a pass on a key that has failed before, a failure on
- * a key that has passed before, or a within-run retry. The counts fold this
- * run in.
+ * rows are recorded: a failure on a key that has passed before, a pass on a
+ * key that already did so, or a within-run retry. A first pass after only
+ * failures is a recovery, not a flake. The counts fold this run in.
  *
  * The cost follows the run's colour. No candidate (every task a hit or a
  * skip): no query. A green miss: one probe of the `runs_failed` partial
@@ -148,7 +154,7 @@ export function detectFlaky(db: Database, candidates: readonly FlakyCandidate[])
     (c) => c.status === 'failed' || c.attempts > 1 || everFailed.has(keyOf(c)),
   )
   if (suspects.length === 0) return []
-  const counts = new Map<string, { passes: number; failures: number }>()
+  const counts = new Map<string, { passes: number; failures: number; relapses: number }>()
   chunked(suspects, (chunk) => {
     const rows = db
       .query(keyOutcomesSql('runs', ` AND hash IN (${chunk.map(() => '?').join(', ')})`))
@@ -158,27 +164,30 @@ export function detectFlaky(db: Database, candidates: readonly FlakyCandidate[])
       hash: string
       passes: number
       failures: number
+      relapses: number
     }[]
-    for (const r of rows) counts.set(keyOf(r), { passes: r.passes, failures: r.failures })
+    for (const r of rows)
+      counts.set(keyOf(r), { passes: r.passes, failures: r.failures, relapses: r.relapses })
   })
   const out: FlakyFinding[] = []
   for (const c of suspects) {
-    const before = counts.get(keyOf(c)) ?? { passes: 0, failures: 0 }
+    const before = counts.get(keyOf(c)) ?? { passes: 0, failures: 0, relapses: 0 }
+    const relapsed = c.status === 'failed' ? before.passes > 0 : before.relapses > 0
+    if (!relapsed && c.attempts <= 1) continue
     const passes = before.passes + (c.status === 'success' ? 1 : 0)
     const failures = before.failures + (c.status === 'failed' ? 1 : 0)
-    if (!(passes > 0 && failures > 0) && c.attempts <= 1) continue
     out.push({ ...c, taskId: `${c.project}#${c.task}`, passes, failures })
   }
   return out
 }
 
-/** One task the recorded history shows both passing and failing on unchanged inputs. */
+/** One task the recorded history shows failing on a key that had passed. */
 export interface FlakyTask {
   /** `project#task`. */
   taskId: string
   project: string
   task: string
-  /** Distinct cache keys that both passed and failed. */
+  /** Distinct cache keys that failed after they had passed. */
   keys: number
   /** Outcomes over those keys. */
   passes: number
@@ -186,7 +195,7 @@ export interface FlakyTask {
 }
 
 /**
- * Every task with a mixed-outcome key anywhere in the retained history
+ * Every task with a key that failed after it had passed anywhere in the retained history
  * (30 days, `RunHistory.pruneOlderThan`), most failures first: the
  * doctor's list. A pass that took a retry mixes its key on its own: it is
  * one `success` row whose failed attempts count as failures (`vx info`
@@ -198,8 +207,8 @@ export function flakyTasks(db: Database): FlakyTask[] {
     .query(
       `SELECT project, task, COUNT(*) AS keys, SUM(passes) AS passes, SUM(failures) AS failures
        FROM (SELECT project, task, passes, failures + retried_failures AS failures
-             FROM (${keyOutcomesSql('runs')}))
-       WHERE failures > 0 AND passes > 0
+             FROM (${keyOutcomesSql('runs')})
+             WHERE relapses > 0 OR retried_failures > 0)
        GROUP BY project, task
        ORDER BY failures DESC, passes DESC, project, task`,
     )

package/src/orchestrator/framed-output.ts

@@ -27,9 +27,9 @@
 
 import { withForwardArgs } from '../exec/index.js'
 import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
-import { maskedCommand } from '../util/index.js'
+import { formatElapsed, maskedCommand } from '../util/index.js'
 import { paint, type ColorSupport } from './colors.js'
-import { formatDuration, neverStarted } from './summary.js'
+import { neverStarted } from './summary.js'
 import { outcomeLabel, ranNoCache, skippedReason } from './events.js'
 
 const NO_COLOR: ColorSupport = { enabled: false }
@@ -220,7 +220,7 @@ const CACHE_COL = 8 // "no-cache" / "remote" / "local" / "fresh" / "miss"
 
 /** Right-align the duration in a TIME_COL cell (pad on the left). */
 function timeCell(ms: number | null, colors: ColorSupport): string {
-  const raw = ms === null ? '' : formatDuration(ms)
+  const raw = ms === null ? '' : formatElapsed(ms)
   return ' '.repeat(Math.max(0, TIME_COL - raw.length)) + paint('', raw, colors, { dim: true })
 }
 
@@ -487,7 +487,7 @@ export function formatFrameClose(
   // both ends of the frame as a long-lived task.
   const tail =
     persistent && outcome.status === 'success'
-      ? ` ${paint('', `(${formatDuration(outcome.durationMs)})`, colors, { dim: true })} ${paint(ACCENT, 'running', colors)}`
+      ? ` ${paint('', `(${formatElapsed(outcome.durationMs)})`, colors, { dim: true })} ${paint(ACCENT, 'running', colors)}`
       : formatBlockFooter(outcome, colors)
   const close = `${corner('└─')} ${mark}${paintTaskId(node, colors, { bold: true })} ${corner('──')}${tail}`
   const violations = violationSection(outcome, colors)
@@ -594,7 +594,7 @@ function formatBlockFooter(o: TaskOutcome, colors: ColorSupport): string {
   // saved" on the strength of it. The stored time lives on
   // `TaskOutcome.storedDurationMs`.) Status differs by outcome — see
   // formatStatusTag.
-  const dur = paint('', `(${formatDuration(o.durationMs)})`, colors, { dim: true })
+  const dur = paint('', `(${formatElapsed(o.durationMs)})`, colors, { dim: true })
   const tag = formatStatusTag(o, colors)
   return ` ${dur} ${tag}${flakyNote(o, colors)}`
 }

package/src/orchestrator/hit-restore.ts

@@ -130,7 +130,7 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
         // set that shrank would otherwise vouch for a tree it never saw,
         // and the failure it would let through is a skipped restore.
         const covers = dirPrefixes.every((pre) => dirRows.some((r) => r.path === pre))
-        setKnown = covers && (await args.cache.outputDirsCurrent!(node.projectDir, dirRows))
+        setKnown = covers && (await args.cache.outputDirsCurrent(node.projectDir, dirRows))
         endDirs()
       }
       let treeMatches: boolean

package/src/orchestrator/index.ts

@@ -30,7 +30,6 @@ export { defaultLogger, resolveOutputView } from './logger.js'
 export { detectColors, paint, type ColorSupport } from './colors.js'
 export type { Logger, OutputView } from './logger.js'
 export type { RunPlan, PlannedTask, PlanPrediction, CacheStatus } from './plan.js'
-export { formatDuration } from './summary.js'
 export {
   createEventBus,
   wireForwarder,

package/src/orchestrator/keyed-projects.ts

@@ -93,9 +93,12 @@ export function foldedDeps(node: TaskNode, nodeOf: (id: string) => TaskNode): Fo
  * the hashes are. An exec task's key folds its own id (`task:<id>`), so its
  * id is enough; a group's hash is a roll-up of its members' ids and hashes
  * with no id of its own, so two groups over the same members hash alike.
+ * The members are `keyUpstream`'s, which `computeGroupHash` is handed: under
+ * `--exclude-dependencies` `node.deps` holds order-only edges and lacks the
+ * dropped ones, and two groups the key told apart shared a unit.
  */
 function foldUnit(node: TaskNode): string {
-  return isGroupTask(node) && node.config.cache === undefined
-    ? `group|${[...node.deps].sort().join('|')}`
-    : `task|${node.id}`
+  if (!isGroupTask(node) || node.config.cache !== undefined) return `task|${node.id}`
+  const members = [...keyedDeps(node), ...(node.excludedUpstream ?? []).map((u) => u.node.id)]
+  return `group|${members.sort().join('|')}`
 }

package/src/orchestrator/lockfile-claim.ts

@@ -71,6 +71,7 @@ interface Digests {
 
 interface Memo {
   version: number
+  claimant: string
   lock: string
   /** `extraFiles` → content hash when the digests were computed. */
   extras?: Record<string, string>
@@ -120,6 +121,11 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
   const { file, digest, version } = options
   const scope = options.scope ?? 'project'
   const part = options.part ?? 'deps'
+  // `version` is one claimant's counter, and another claimant of the file
+  // at the same number read this one's memo: one that named no extra file
+  // left the other's patch edits out of its key (X-130). The functions'
+  // source stands for the claimant; a rebuild that changes it is a miss.
+  const claimant = xxh3hex([part, String(digest), String(options.extraFiles ?? '')].join('\0'))
   if (scope !== 'project' && scope !== 'workspace') {
     throw new Error(`scope must be 'project' or 'workspace', not ${JSON.stringify(scope)}`)
   }
@@ -159,7 +165,7 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
     const memoFile = path.join(cacheDir, 'lockfile-claims', `${file}.json`)
     // The extra files the last digest read, and their hashes now: a warm run
     // re-hashes the files the memo names and never parses to learn them.
-    const memo = await readMemo(memoFile, version, lockHash)
+    const memo = await readMemo(memoFile, version, claimant, lockHash)
     let extras: Record<string, string> = {}
     let extraStats: Record<string, string> = {}
     let importers: ReadonlyMap<string, string> | undefined
@@ -182,8 +188,7 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
           ? new Map<string, string>()
           : await computeAndMemo(
               memoFile,
-              version,
-              lockHash,
+              { version, claimant, lock: lockHash },
               extras,
               digest(text, new Map(Object.entries(extras))),
             )
@@ -273,11 +278,14 @@ function importerOf(workspaceRoot: string, projectDir: string): string {
 async function readMemo(
   memoFile: string,
   version: number,
+  claimant: string,
   lock: string,
 ): Promise<{ extras: Record<string, string>; importers: Map<string, string> } | undefined> {
   try {
     const memo = (await Bun.file(memoFile).json()) as Memo
-    if (memo.version !== version || memo.lock !== lock) return undefined
+    if (memo.version !== version || memo.claimant !== claimant || memo.lock !== lock) {
+      return undefined
+    }
     return { extras: memo.extras ?? {}, importers: new Map(Object.entries(memo.importers)) }
   } catch {
     return undefined
@@ -286,12 +294,11 @@ async function readMemo(
 
 async function computeAndMemo(
   memoFile: string,
-  version: number,
-  lock: string,
+  identity: Pick<Memo, 'version' | 'claimant' | 'lock'>,
   extras: Record<string, string>,
   importers: ReadonlyMap<string, string>,
 ): Promise<ReadonlyMap<string, string>> {
-  const memo: Memo = { version, lock, extras, importers: Object.fromEntries(importers) }
+  const memo: Memo = { ...identity, extras, importers: Object.fromEntries(importers) }
   // Write-then-rename: a reader never sees a half-written memo, and two
   // concurrent runs each land a whole one.
   const tmp = `${memoFile}.tmp-${process.pid}-${Date.now()}`

package/src/orchestrator/logger.ts

@@ -19,9 +19,16 @@ import {
   type StatusStream,
   type WorkerSlot,
 } from './status-line.js'
-import { formatDuration, formatSummarySection, neverStarted, type RunContext } from './summary.js'
+import { formatSummarySection, neverStarted, type RunContext } from './summary.js'
 import { isGroupTask } from '../graph/index.js'
-import { appendTail, createTail, resetTail, tailText, type Tail } from '../util/index.js'
+import {
+  appendTail,
+  createTail,
+  formatElapsed,
+  resetTail,
+  tailText,
+  type Tail,
+} from '../util/index.js'
 import { isCacheHit } from './telemetry.js'
 import { failedLabel, outcomeWord, ranNoCache } from './events.js'
 
@@ -511,9 +518,11 @@ export function defaultLogger(
       killStatus()
       // Persistent tails first: they are context for whatever ran against
       // the server, so they read above the failures they explain. `none`
-      // and `errors-only` state their contracts absolutely (no per-task
-      // output / only failed tasks print), so they stay silent — the tail
-      // is still captured and still bounded, just never printed. Guarded
+      // prints no per-task output and `errors-only` only failed tasks: a
+      // server that died on its own before the run stopped it is failed by
+      // now (run.ts sets its outcome in place), and under `errors-only` its
+      // tail was dropped with the healthy ones', so the crash read only as a
+      // count (WD-25). The rest is still captured and bounded. Guarded
       // like the failures below: run() calls runEnd twice on the success
       // path (once before the summary, once in its finally), and though the
       // bus delivers `run:end` once (`busLogger`), a renderer an embedder
@@ -521,12 +530,13 @@ export function defaultLogger(
       if (flushedPersistent) flushKept()
       if (!flushedPersistent) {
         flushedPersistent = true
-        if (view.mode !== 'none' && view.mode !== 'errors-only') {
+        if (view.mode !== 'none') {
           for (const t of persistentTails.values()) {
             // No outcome means the task never completed — it is still
             // pre-ready, so there is no "since ready" window to render and
             // its buffered output belongs to the frame it never got.
             if (t.outcome === undefined) continue
+            if (view.mode === 'errors-only' && t.outcome.status !== 'failed') continue
             emitBlock(
               fenced(
                 formatPersistentTailBlock(
@@ -880,7 +890,7 @@ export function defaultLogger(
             } else {
               emitBlock(
                 `::group::${ghaData(
-                  `${node.id} (${outcomeWord(outcome)} ${formatDuration(outcome.durationMs)})`,
+                  `${node.id} (${outcomeWord(outcome)} ${formatElapsed(outcome.durationMs)})`,
                 )}\n${body}::endgroup::\n`,
               )
             }

package/src/orchestrator/miss-save.ts

@@ -148,11 +148,9 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
     // `cache.outputs` is not a write grant; `exec.sandbox.allow.write` is.
     const sandboxed = node.config.exec?.sandbox !== undefined
     const grantsWrite = (node.config.exec?.sandbox?.allow?.write?.length ?? 0) > 0
-    // The workspace side too: a `workspaceFiles` directory linked out of
-    // the workspace drops every file the same way (M-65).
-    const linkedOut =
-      outputDirLinkedOut(node.projectDir, a.outputs, 'the project') ??
-      outputDirLinkedOut(a.workspaceRoot, a.wsOutputs, 'the workspace')
+    // A `workspaceFiles` directory linked out of the workspace drops every
+    // file (M-65); a project one is refused by the resolver (X-88).
+    const linkedOut = outputDirLinkedOut(a.workspaceRoot, a.wsOutputs)
     log.status(
       `[vx] ${node.id}: cache.outputs matched no files (${[...a.outputs, ...a.wsOutputs].join(', ')}) — ` +
         `an empty artifact is saved; a later hit restores nothing` +
@@ -300,15 +298,13 @@ function markWritten(
 }
 
 /**
- * The first output directory a pattern names that is a symlink resolving
- * outside `baseDir` (the project, or the workspace root for
- * `workspaceFiles`): every file under it is dropped as outside, and the
- * empty-artifact warning blamed the glob (M-61, M-65).
+ * The first `workspaceFiles` directory that is a symlink resolving outside
+ * the workspace root: every file under it is dropped as outside, and the
+ * empty-artifact warning blamed the glob (M-65).
  */
 function outputDirLinkedOut(
   baseDir: string,
   outputs: readonly string[],
-  base: string,
 ): { dir: string; target: string; base: string } | undefined {
   const realProject = realpathOrNull(baseDir) ?? baseDir
   // `dist` names the tree `dist/**`: the same reading the resolver gives.
@@ -326,7 +322,7 @@ function outputDirLinkedOut(
       }
       const target = realpathOrNull(abs)
       if (target !== null && target !== realProject && !target.startsWith(realProject + path.sep)) {
-        return { dir, target, base }
+        return { dir, target, base: 'the workspace' }
       }
     }
   }

package/src/orchestrator/plan.ts

@@ -14,16 +14,10 @@
 import type { CacheLayer, CachePolicy, GitFilesCache } from '../cache/index.js'
 import { cachesNothing, FULL_CACHE_POLICY } from '../cache/index.js'
 import { ranNoCache } from './events.js'
-import {
-  idleServers,
-  isGroupTask,
-  runGraph,
-  type TaskNode,
-  type TaskOutcome,
-} from '../graph/index.js'
+import { idleServers, isGroupTask, runGraph, type TaskNode } from '../graph/index.js'
 import type { HistoryProvider } from './history.js'
 import { computeGroupKey, computeTaskHash } from './task-hash.js'
-import { keyUpstream } from './upstream.js'
+import { keyedOutcome, keyUpstream } from './upstream.js'
 
 export type CacheStatus =
   | 'hit-local' // entry exists in local cache
@@ -157,7 +151,7 @@ export async function plan(args: PlanArgs): Promise<RunPlan> {
       }
       if (isGroupTask(node)) {
         cacheStatusById.set(node.id, 'group')
-        return planOutcome(node, await computeGroupKey(hashArgs))
+        return keyedOutcome(node, await computeGroupKey(hashArgs))
       }
 
       const hash = await computeTaskHash(hashArgs)
@@ -180,7 +174,7 @@ export async function plan(args: PlanArgs): Promise<RunPlan> {
         status = where === null ? 'miss' : where === 'remote' ? 'hit-remote' : 'hit-local'
       }
       cacheStatusById.set(node.id, status)
-      return planOutcome(node, hash)
+      return keyedOutcome(node, hash)
     },
   })
 
@@ -303,13 +297,3 @@ function predictPlan(tasks: PlannedTask[]): PlanPrediction {
   }
   return { wallMs, workMs, unknownCount }
 }
-
-function planOutcome(node: TaskNode, hash: string | undefined): TaskOutcome {
-  return {
-    node,
-    status: 'success',
-    exitCode: 0,
-    durationMs: 0,
-    ...(hash !== undefined ? { hash } : {}),
-  }
-}

package/src/orchestrator/plugin-host.ts

@@ -10,7 +10,7 @@
 import path from 'node:path'
 import { ChainedCache, type CacheLayer } from '../cache/index.js'
 import { localExecutor, type TaskExecutor } from '../exec/index.js'
-import { settleWithin, teardownTimeoutMs, UserError } from '../util/index.js'
+import { maskedLine, settleWithin, teardownTimeoutMs, UserError } from '../util/index.js'
 import type { ProjectConfig, WorkspaceConfig, WorkspaceRules } from '../config.js'
 import { checkGraph, type TaskNode } from '../graph/index.js'
 import type {
@@ -86,8 +86,13 @@ async function safe<T>(plugin: VxPlugin, hook: string, fn: () => T | Promise<T>)
   try {
     return await fn()
   } catch (err) {
+    // Masked here, not by whoever prints it: an embedder of `run()` and
+    // `vx mcp` print it as they get it, and the throw quotes what the
+    // plugin was told (a remote's reply, a header) (L-11).
     throw new UserError(
-      `plugin '${plugin.name}' failed in ${hook}: ${err instanceof Error ? err.message : String(err)}`,
+      maskedLine(
+        `plugin '${plugin.name}' failed in ${hook}: ${err instanceof Error ? err.message : String(err)}`,
+      ),
     )
   }
 }

package/src/orchestrator/plugin.ts

@@ -15,7 +15,7 @@ import type { Cache, CacheLayer, CachePolicy } from '../cache/index.js'
 import { PLUGIN_PACKAGE, type ProjectConfig, type WorkspaceConfig } from '../config.js'
 import type { TaskExecutor } from '../exec/index.js'
 import type { TaskNode, TaskOutcome } from '../graph/index.js'
-import { nearest, UserError } from '../util/index.js'
+import { maskedLine, nearest, UserError } from '../util/index.js'
 import type { ProjectMeta } from '../workspace/index.js'
 import type { EventBus, RunStartInfo } from './events.js'
 import type { TelemetryContext, TelemetrySink } from './telemetry.js'
@@ -716,7 +716,10 @@ export async function installPlugins(args: InstallPluginsArgs): Promise<() => vo
       for (const d of disposers) d()
       throw new PluginSetupError(
         plugin,
-        `plugin '${plugin.name}' failed in setup: ${err instanceof Error ? err.message : String(err)}`,
+        // Masked at the source, as plugin-host.ts's `safe()` does (L-11).
+        maskedLine(
+          `plugin '${plugin.name}' failed in setup: ${err instanceof Error ? err.message : String(err)}`,
+        ),
       )
     }
   }

package/src/orchestrator/prepare.ts

@@ -379,9 +379,11 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
     // it, and the run said no project did (C-3). Only what is still
     // unjudged pays for the rest of the workspace.
     unresolvedTasks = undeclaredIn(unresolvedTasks, projects)
+    // By name, not by count: a config-less project in the scope counts as
+    // loaded, and a changed one hid an unloaded `test` declarer (X-129).
     if (
-      projects.size < projectsWithConfigs.length &&
-      unresolvedTasks.some((t) => !t.includes('#'))
+      unresolvedTasks.some((t) => !t.includes('#')) &&
+      projectsWithConfigs.some((m) => !projects.has(m.name))
     ) {
       unresolvedTasks = await declaredNowhere(unresolvedTasks, () =>
         loadProjects({ ...loadArgs, seeds: 'all', closure: false, staged: projects }),

package/src/orchestrator/projects.ts

@@ -321,7 +321,7 @@ const DEFAULT_BUILD: TaskConfig = Object.freeze({
     inputs: Object.freeze({ files: Object.freeze(['**']) }),
     outputs: Object.freeze({ files: Object.freeze([]) }),
   }),
-}) as unknown as TaskConfig
+})
 
 /** The default `build`, which a menu of the tasks a user declared leaves out. */
 export function isDefaultBuild(task: TaskConfig | undefined): boolean {

package/src/orchestrator/run-artifacts.ts

@@ -94,8 +94,8 @@ function taskEntry(o: TaskOutcome, flaky?: FlakyFinding): SummaryTaskJson {
     // task that could never hit (its `hash` is still set — dependents fold
     // it). Present only when true, so every other row is byte-identical.
     ...(ranNoCache(o) ? { noCache: true } : {}),
-    // Present only when the run proved the task flaky: this exact key has
-    // both passed and failed on record (this run counted), or the task
+    // Present only when the run proved the task flaky: this exact key
+    // failed after it had passed (this run counted), or the task
     // needed a retry. A consumer gating on `failed` can tell a break from a
     // flake without the history; every other row is byte-identical.
     ...(flaky !== undefined

package/src/orchestrator/run-context.ts

@@ -379,7 +379,7 @@ function ciLinks(provider: string, env: Record<string, string | undefined>): CiL
     default:
       return {}
   }
-  return Object.fromEntries(Object.entries(links).filter(([, x]) => x !== undefined)) as CiLinks
+  return Object.fromEntries(Object.entries(links).filter(([, x]) => x !== undefined))
 }
 
 /** Host name (null on failure) + platform + arch. */