@vzn/vx 0.0.632 → 0.0.634

package/src/cli/init.ts

@@ -1,4 +1,4 @@
-// `vx init [--dry] [--force] [--mjs] [--native|--keep]` — a workspace from nowhere:
+// `vx init [--dry [--format json]] [--force] [--mjs] [--native|--keep]` — a workspace from nowhere:
 // one vx.config.ts per package from its package.json scripts, and the
 // workspace file every run needs. In a Turbo or Nx repo it hands over to
 // `@vzn/vx-migrate` (`migrate`), which asks a terminal whether to write
@@ -10,7 +10,7 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { mkdir, unlink } from 'node:fs/promises'
 import path from 'node:path'
-import { flagHint, seeHelp } from './help.js'
+import { flagHint, formatValue, refuse, seeHelp } from './help.js'
 import { PLUGIN_TEMPLATES } from './plugin-templates.js'
 import { isCompiledBinary } from './upgrade.js'
 import { VERSION } from '../version.js'
@@ -34,6 +34,8 @@ interface InitArgs {
   plugin?: string
   /** `--native` / `--keep` in a Turbo or Nx repo; unset, vx-migrate asks a terminal. */
   mode?: 'native' | 'keep'
+  /** `--format json` (with `--dry`): the plan as one JSON document. */
+  json?: boolean
   error?: string
 }
 
@@ -51,6 +53,10 @@ export function parseInitArgs(args: readonly string[]): InitArgs {
         }
       }
       out.plugin = seam
+    } else if (a === '--format' || a.startsWith('--format=')) {
+      const fv = formatValue(a === '--format' ? args[++i] : a.slice('--format='.length), 'init')
+      if (typeof fv === 'object') return { ...out, error: fv.error }
+      out.json = fv === 'json'
     } else if (a === '--dry') out.dry = true
     else if (a === '--force') out.force = true
     else if (a === '--mjs') out.mjs = true
@@ -81,9 +87,15 @@ export function parseInitArgs(args: readonly string[]): InitArgs {
 
 export async function initCmd(args: readonly string[]): Promise<number> {
   const parsed = parseInitArgs(args)
-  if (parsed.error) {
-    process.stderr.write(`vx init: ${parsed.error}\n`)
-    return 1
+  if (parsed.error) return refuse('init', args, parsed.error, 'VX_E_USAGE')
+  // In the verb, not the parser: completion asks the parser one flag at a time.
+  if (parsed.json === true && (!parsed.dry || parsed.plugin !== undefined)) {
+    return refuse(
+      'init',
+      args,
+      `--format json prints the workspace plan, so it needs --dry and no --plugin${seeHelp('init')}`,
+      'VX_E_USAGE',
+    )
   }
   if (parsed.plugin !== undefined) return scaffoldPlugin(parsed.plugin, parsed)
   const reads: LoadReads = new Map()
@@ -163,6 +175,7 @@ export async function initCmd(args: readonly string[]): Promise<number> {
     notes: [...(await unreadWorkspaces(root, workspace.packageGlobs)), ...unmapped],
     unmapped: unmapped.length > 0,
     dry: parsed.dry,
+    json: parsed.json === true,
     force: parsed.force,
     init: true,
     format: parsed.mjs ? 'mjs' : 'ts',
@@ -211,6 +224,7 @@ async function migrate(root: string, args: InitArgs): Promise<number> {
     args.force && '--force',
     args.mjs && '--mjs',
     args.mode === 'native' && '--native',
+    args.json === true && '--format=json',
   ].filter((f): f is string => typeof f === 'string')
   return Bun.spawn(migrateCommand(root, flags), {
     cwd: root,
@@ -257,7 +271,7 @@ async function adopt(
       )
     }
   } else if (args.dry) {
-    process.stdout.write(`── ${name} ──\n${text}\n`)
+    if (args.json !== true) process.stdout.write(`── ${name} ──\n${text}\n`)
   } else {
     if (existing !== undefined && existing !== name) await unlink(path.join(root, existing))
     await Bun.write(path.join(root, name), text)
@@ -278,6 +292,21 @@ async function adopt(
         : kept
           ? ''
           : `${cache}(): ${remote}, so vx shares that remote cache (inert where the variable is unset).\n`
+  if (args.json === true) {
+    process.stdout.write(
+      `${JSON.stringify({
+        dry: true,
+        source,
+        files: kept ? [] : [{ path: name, contents: text }],
+        kept: kept ? [existing] : [],
+        replaced: !kept && existing !== undefined && existing !== name ? [existing] : [],
+        todos: [],
+        notes: cacheLine === '' ? [] : [cacheLine.trimEnd()],
+        next: adoptionNext(root, runner, source),
+      })}\n`,
+    )
+    return 0
+  }
   process.stdout.write(
     `vx init: ${source} found — ${runner}() from @vzn/vx-migrate, a temporary start until vx init --native writes native config; nothing else written.\n` +
       `${wrote}\n${cacheLine}\nnext: ${adoptionNext(root, runner, source)}\n`,
@@ -392,12 +421,17 @@ const INSTALL: Record<PackageManager, string> = {
 
 const EXEC: Record<PackageManager, string> = { pnpm: 'pnpm', yarn: 'yarn', bun: 'bunx', npm: 'npx' }
 
-/** Install what the workspace file imports, if missing, then run the repo's build. */
+/**
+ * Install what the workspace file imports, if missing, then run the repo's
+ * build. Pinned to this vx's version: every @vzn package releases in
+ * lockstep, and `latest` beside an older vx mismatched them (agent trial 2).
+ */
 export function adoptionNext(
   root: string,
   runner: 'turbo' | 'nx',
   source: string,
   needs: readonly string[] = ['@vzn/vx', '@vzn/vx-migrate'],
+  version: string = VERSION,
 ): string {
   const pm = LOCKFILES.find(([f]) => existsSync(path.join(root, f)))?.[1] ?? 'npm'
   const missing = needs.filter(
@@ -414,7 +448,9 @@ export function adoptionNext(
     pm === 'yarn' && !readText(path.join(root, 'yarn.lock')).includes('__metadata:')
       ? `${INSTALL.yarn} -W`
       : INSTALL[pm]
-  return `${install} ${missing.join(' ')} && ${run}`
+  // A source checkout is 0.0.0, which npm never had.
+  const pinned = version === '0.0.0' ? missing : missing.map((p) => `${p}@${version}`)
+  return `${install} ${pinned.join(' ')} && ${run}`
 }
 
 function readText(file: string): string {

package/src/cli/lock.ts

@@ -3,7 +3,7 @@
 // current environment. Design: docs/design/config-lock-2026-06.md.
 
 import type { ProjectConfig } from '../config.js'
-import { flagHint, refusedWord, seeHelp } from './help.js'
+import { flagHint, formatValue, refuse, refusedWord, seeHelp } from './help.js'
 import { relPosix, secretMask, xxh3hex } from '../util/index.js'
 import {
   findWorkspaceRoot,
@@ -22,16 +22,22 @@ import { discoverCliProjects } from './workspace-config.js'
 
 interface LockArgs {
   check: boolean
+  format: 'pretty' | 'json'
   error?: string
 }
 
 export function parseLockArgs(args: readonly string[]): LockArgs {
-  const out: LockArgs = { check: false }
-  for (const a of args) {
+  const out: LockArgs = { check: false, format: 'pretty' }
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i]!
     if (a === '--check') out.check = true
-    else
+    else if (a === '--format' || a.startsWith('--format=')) {
+      const fv = formatValue(a === '--format' ? args[++i] : a.slice(9), 'lock')
+      if (typeof fv === 'object') return { ...out, ...fv }
+      out.format = fv
+    } else
       return {
-        check: false,
+        ...out,
         error: `${refusedWord(a)}: ${a}${flagHint('lock', a)}${seeHelp('lock')}`,
       }
   }
@@ -42,10 +48,15 @@ type ConfiguredMeta = ProjectMeta & { configPath: string }
 
 export async function lockCmd(args: readonly string[]): Promise<number> {
   const parsed = parseLockArgs(args)
-  if (parsed.error) {
-    process.stderr.write(`vx lock: ${parsed.error}\n`)
-    return 1
-  }
+  if (parsed.error) return refuse('lock', args, parsed.error, 'VX_E_USAGE')
+  // Writing the lock prints one line; only the audit has an answer to shape.
+  if (parsed.format === 'json' && !parsed.check)
+    return refuse(
+      'lock',
+      args,
+      `--format json answers --check only${seeHelp('lock')}`,
+      'VX_E_USAGE',
+    )
   const reads: LoadReads = new Map()
   const root = await findWorkspaceRoot(process.cwd(), reads)
   const workspace = await loadWorkspace(root, reads)
@@ -62,7 +73,7 @@ export async function lockCmd(args: readonly string[]): Promise<number> {
   // count above leaves out — `locked 0 project configs` on a turbo() repo
   // read like an audit of something (2026-09-16).
   const bare = all.length - metas.length
-  if (parsed.check) return await checkLock(root, metas, bare)
+  if (parsed.check) return await checkLock(root, metas, bare, parsed.format === 'json')
   return await writeLock(root, metas, bare)
 }
 
@@ -154,13 +165,29 @@ function secretsIn(projects: Record<string, LockfileEntry>): Array<{ at: string;
  *      catches eval-time env-var drift that file hashes cannot see —
  *      file bytes unchanged, resolved value changed.
  */
-async function checkLock(root: string, metas: ConfiguredMeta[], bare: number): Promise<number> {
+async function checkLock(
+  root: string,
+  metas: ConfiguredMeta[],
+  bare: number,
+  json: boolean,
+): Promise<number> {
+  const answer = (problems: string[]): number => {
+    if (json) {
+      const out = {
+        upToDate: problems.length === 0,
+        audited: metas.length,
+        notAudited: bare,
+        problems,
+      }
+      process.stdout.write(`${JSON.stringify(out)}\n`)
+    }
+    return problems.length === 0 ? 0 : 1
+  }
   const lock = await readLockfile(root)
   if (!lock) {
-    process.stderr.write(
-      `vx lock --check: no ${LOCKFILE_NAME} at ${root} — run \`vx lock\` first\n`,
-    )
-    return 1
+    const problem = `no ${LOCKFILE_NAME} at ${root} — run \`vx lock\` first`
+    if (!json) process.stderr.write(`vx lock --check: ${problem}\n`)
+    return answer([problem])
   }
   const results = await Promise.all(
     metas.map(async (m): Promise<string | null> => {
@@ -200,6 +227,7 @@ async function checkLock(root: string, metas: ConfiguredMeta[], bare: number): P
       )
     }
   }
+  if (json) return answer(failures)
   if (failures.length > 0) {
     for (const f of failures) process.stderr.write(`vx lock --check: ${f}\n`)
     return 1

package/src/cli/plan-format.ts

@@ -145,10 +145,12 @@ export interface PlanTaskJson {
   affected?: AffectedReason
 }
 
-export function formatPlanJson(plan: RunPlan): string {
+/** `affectedBase`: the ref a bare `--affected` guessed (or was given), so a reader knows what the diff was against. */
+export function formatPlanJson(plan: RunPlan, affectedBase?: string): string {
   return (
     JSON.stringify(
       {
+        ...(affectedBase !== undefined ? { affectedBase } : {}),
         tasks: plan.tasks.map((t): PlanTaskJson => {
           const description = shownDescription(t)
           return {

package/src/cli/run.ts

@@ -521,6 +521,8 @@ export async function resolveRunOptions(
   cwd: string,
   tasks: readonly string[],
   verb: 'run' | 'watch' = 'run',
+  /** Given, it learns the ref `--affected` diffed from (`--dry=json` states it). */
+  scopeOut?: { affectedBase?: string },
 ): Promise<RunOptions | { error: string } | { nothingSelected: string }> {
   for (const t of tasks) {
     const idx = t.indexOf('#')
@@ -536,6 +538,9 @@ export async function resolveRunOptions(
   const scope = await scopeFilters(parsed, cwd)
   if ('error' in scope) return scope
   const { filterStrings, affectedFilter } = scope
+  // `...[<base>]`: the base alone.
+  if (scopeOut !== undefined && affectedFilter !== undefined)
+    scopeOut.affectedBase = affectedFilter.slice(4, -1)
 
   // Project scope applies to bare task names only. Anchored entries
   // (pkg#task) resolve directly to their own project regardless.
@@ -709,7 +714,8 @@ export async function runCmd(args: readonly string[]): Promise<number> {
     tasks = [picked]
   }
 
-  const resolved = await resolveRunOptions(parsed, cwd, tasks)
+  const scopeOut: { affectedBase?: string } = {}
+  const resolved = await resolveRunOptions(parsed, cwd, tasks, 'run', scopeOut)
   if ('error' in resolved) return refuse('run', args, resolved.error, 'VX_E_USAGE')
   if ('nothingSelected' in resolved) {
     process.stderr.write(`vx run: ${resolved.nothingSelected}\n`)
@@ -769,7 +775,7 @@ export async function runCmd(args: readonly string[]): Promise<number> {
         }
       }
     } else if (parsed.dry === 'json') {
-      process.stdout.write(formatPlanJson(plan))
+      process.stdout.write(formatPlanJson(plan, scopeOut.affectedBase))
     } else {
       process.stdout.write(formatPlanText(plan))
     }

package/src/cli/upgrade.ts

@@ -13,7 +13,7 @@
 // deno upgrade — "update" is what package managers do to indexes.
 
 import { constants } from 'node:fs'
-import { access, chmod, chown, link, rename, rm, stat } from 'node:fs/promises'
+import { access, chmod, chown, link, mkdtemp, rename, rm, stat } from 'node:fs/promises'
 import path from 'node:path'
 import { flagHint, seeHelp } from './help.js'
 import { UserError } from '../util/index.js'
@@ -247,8 +247,20 @@ export async function replaceBinary(
       `vx upgrade: the download did not match the release's SHA-256 (expected ${sha256}, got ${got}) — nothing replaced; try again, and if it repeats the asset is not the one the release published`,
     )
   }
-  const tmp = `${dest}.upgrade-${process.pid}`
-  const old = `${dest}.previous-${process.pid}`
+  // A fresh directory beside the binary, not a name built from the pid:
+  // anyone who can write the install directory could plant a link at a
+  // predictable name, and a `sudo vx upgrade` wrote through it as root.
+  let stage: string
+  try {
+    stage = await mkdtemp(path.join(dir, '.vx-upgrade-'))
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err)
+    throw new UserError(
+      `vx upgrade: could not stage the new binary in ${dir} (${msg}) — nothing replaced; check the permissions of ${dir}`,
+    )
+  }
+  const tmp = path.join(stage, 'new')
+  const old = path.join(stage, 'previous')
   let kept = false
   try {
     const was = await stat(dest).catch(() => null)
@@ -265,18 +277,18 @@ export async function replaceBinary(
     }
     await rename(tmp, dest)
   } catch (err) {
-    await rm(tmp, { force: true })
-    if (kept) await rm(old, { force: true })
+    await rm(stage, { recursive: true, force: true })
     const msg = err instanceof Error ? err.message : String(err)
     throw new UserError(
       `vx upgrade: could not replace ${dest} (${msg}) — nothing replaced; check the permissions of ${dest} and its directory`,
     )
   }
   if (starts === undefined || starts(dest)) {
-    if (kept) await rm(old, { force: true })
+    await rm(stage, { recursive: true, force: true })
     return
   }
   if (kept) await rename(old, dest)
+  await rm(stage, { recursive: true, force: true })
   throw new UserError(
     `vx upgrade: the new binary did not start on this machine (\`${dest} --version\` failed)${kept ? ' — the previous vx is back in place' : ''}. Nothing else changed; report it with this os/arch`,
   )

package/src/config.ts

@@ -46,6 +46,15 @@ export interface WorkspaceConfig {
    * folded into a cache key.
    */
   cacheScope?: string
+  /**
+   * Which ready task starts first when there are more than workers, with no
+   * timings: `most-work` (the default) the one the most work waits on at
+   * any depth, `critical-path` the head of the longest chain of tasks,
+   * `direct-dependents` the one the most tasks wait on directly (Nx's
+   * rule), `ready-order` the one that became ready first (Turbo's). A
+   * `schedule` plugin's weights still come first; this breaks their ties.
+   */
+  schedule?: 'most-work' | 'critical-path' | 'direct-dependents' | 'ready-order'
   /**
    * Graph rules a run checks before it schedules anything. Each is on unless
    * set to `false`; turning one off allows a shape vx handles correctly but

package/src/graph/priorities.ts

@@ -125,20 +125,26 @@ export function computeReverseDepCount(nodes: Map<string, TaskNode>): Map<string
   }
 
   // Reverse-topo sweep: every direct dependent's closure is final
-  // before its dependency folds it in. closure[i] = bitset over node
-  // indices of i's transitive dependents.
+  // before its dependency folds it in. closure[t] = bitset over topo
+  // POSITIONS of the node at position t's transitive dependents. A
+  // dependent sits after its dependency, so a closure holds only bits
+  // past its own position, and each OR starts at the dependent's word:
+  // half the words of indexing by insertion order on a layered graph.
+  const pos = new Int32Array(n)
+  for (let t = 0; t < tail; t++) pos[topo[t]!] = t
   const closure = new Uint32Array(n * words)
   const counts = new Map<string, number>()
   for (let t = tail - 1; t >= 0; t--) {
     const i = topo[t]!
-    const base = i * words
-    for (const r of directReverse[i]!) {
+    const base = t * words
+    for (const ri of directReverse[i]!) {
+      const r = pos[ri]!
       closure[base + (r >>> 5)]! |= 1 << (r & 31)
       const rbase = r * words
-      for (let w = 0; w < words; w++) closure[base + w]! |= closure[rbase + w]!
+      for (let w = r >>> 5; w < words; w++) closure[base + w]! |= closure[rbase + w]!
     }
     let count = 0
-    for (let w = 0; w < words; w++) {
+    for (let w = t >>> 5; w < words; w++) {
       let v = closure[base + w]!
       v = v - ((v >>> 1) & 0x55555555)
       v = (v & 0x33333333) + ((v >>> 2) & 0x33333333)
@@ -153,6 +159,66 @@ export function computeReverseDepCount(nodes: Map<string, TaskNode>): Map<string
   return counts
 }
 
+/**
+ * The ready-queue baseline a workspace may pick in place of the default
+ * (`schedule` in vx.workspace.ts). Each ranks with no timings; a `schedule`
+ * plugin's weights still sort above it, and it breaks their ties.
+ *   - `most-work`: transitive dependents (`computeReverseDepCount`), the default.
+ *   - `critical-path`: steps on the longest chain of dependents below a task.
+ *   - `direct-dependents`: direct dependents only, Nx's rule.
+ *   - `ready-order`: none; the task that became ready first starts first, Turbo's rule.
+ */
+export type ScheduleStrategy = 'most-work' | 'critical-path' | 'direct-dependents' | 'ready-order'
+
+/** The baseline for a strategy other than `most-work`, over the whole graph. */
+export function strategyPriorities(
+  nodes: Map<string, TaskNode>,
+  strategy: Exclude<ScheduleStrategy, 'most-work'>,
+): Map<string, number> {
+  const out = new Map<string, number>()
+  if (strategy === 'ready-order') {
+    for (const id of nodes.keys()) out.set(id, 0)
+    return out
+  }
+  const dependents = new Map<string, string[]>()
+  for (const node of nodes.values()) {
+    for (const dep of node.deps) {
+      if (!nodes.has(dep)) continue
+      const list = dependents.get(dep)
+      if (list === undefined) dependents.set(dep, [node.id])
+      else list.push(node.id)
+    }
+  }
+  if (strategy === 'direct-dependents') {
+    for (const id of nodes.keys()) out.set(id, dependents.get(id)?.length ?? 0)
+    return out
+  }
+  // Longest chain below each task, dependents first: a task's depth is one
+  // more than its deepest dependent's. Iterative, as a deep chain would
+  // overflow a recursive walk.
+  const left = new Map<string, number>()
+  const ready: string[] = []
+  for (const id of nodes.keys()) {
+    const n = dependents.get(id)?.length ?? 0
+    left.set(id, n)
+    if (n === 0) ready.push(id)
+  }
+  while (ready.length > 0) {
+    const id = ready.pop()!
+    let depth = 0
+    for (const d of dependents.get(id) ?? []) depth = Math.max(depth, out.get(d)! + 1)
+    out.set(id, depth)
+    for (const dep of nodes.get(id)!.deps) {
+      if (!nodes.has(dep)) continue
+      const n = left.get(dep)! - 1
+      left.set(dep, n)
+      if (n === 0) ready.push(dep)
+    }
+  }
+  for (const id of nodes.keys()) if (!out.has(id)) out.set(id, 0)
+  return out
+}
+
 export function mergePriorities(
   baseline: ReadonlyMap<string, number>,
   overrides: ReadonlyMap<string, number>,

package/src/graph/scheduler.ts

@@ -5,7 +5,13 @@ import {
   isUserError,
   OUT_OF_FDS_HINT,
 } from '../util/index.js'
-import { computeReverseDepCount, mergePriorities, tieredReverseDepCount } from './priorities.js'
+import {
+  computeReverseDepCount,
+  mergePriorities,
+  strategyPriorities,
+  tieredReverseDepCount,
+  type ScheduleStrategy,
+} from './priorities.js'
 import { isGroupTask, type TaskNode } from './task-graph.js'
 
 /**
@@ -278,6 +284,11 @@ export interface ScheduleOptions {
    * heuristic (the default and historically the only behavior).
    */
   priorities?: ReadonlyMap<string, number>
+  /**
+   * The baseline ranking under `priorities` (`schedule` in vx.workspace.ts).
+   * Undefined or `most-work` is the reverse-deps count above.
+   */
+  strategy?: ScheduleStrategy
   /**
    * Restore-tier task ids: confirmed stable-key LOCAL cache hits (the
    * local short-circuit). A restore-tier task:
@@ -494,9 +505,11 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   // use those weights. Falls back to the reverse-deps-count heuristic
   // for nodes the caller didn't score, so partial coverage works.
   const baseline =
-    options.restoreTier !== undefined && options.restoreTier.size > 0
-      ? tieredReverseDepCount(nodes, options.restoreTier)
-      : computeReverseDepCount(nodes)
+    options.strategy !== undefined && options.strategy !== 'most-work'
+      ? strategyPriorities(nodes, options.strategy)
+      : options.restoreTier !== undefined && options.restoreTier.size > 0
+        ? tieredReverseDepCount(nodes, options.restoreTier)
+        : computeReverseDepCount(nodes)
   const priority: ReadonlyMap<string, number> = options.priorities
     ? mergePriorities(baseline, options.priorities)
     : baseline

package/src/graph/task-graph.ts

@@ -109,7 +109,7 @@ export function isGroupTask(node: TaskNode): boolean {
   return node.config.exec === undefined
 }
 
-/** The default `build` (orchestrator/projects.ts): a config cannot key a group, so it is the one keyed group. */
+/** A keyed group: the default `build` (orchestrator/projects.ts), or a config's group with `cache`. */
 function isKeyedGroup(task: TaskConfig): boolean {
   return task.exec === undefined && task.cache !== undefined
 }
@@ -1505,8 +1505,8 @@ interface Side {
  * `inputs.files` rebased to the root against another task's
  * `outputs.workspaceFiles`, which may land in any project (X-135). A task's own outputs are
  * already subtracted from its inputs, and an output the reader's `!` entries
- * take back whole is no overlap. A keyed group is exempt: the default
- * `build` reads `**` of a config-less dependency and runs nothing, and its
+ * take back whole is no overlap. A keyed group is exempt: it runs nothing
+ * (the default `build` reads `**` of a config-less dependency), and its
  * key waits as before.
  */
 function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: string): void {
@@ -1517,6 +1517,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   const filesWriters: TaskNode[] = []
   let projectReaders = false
   let rootReaders = false
+  const memo: TakeBackMemo = { bySide: new Map(), byList: new Map() }
   const bucket = (name: string): Side[] => {
     let list = byProject.get(name)
     if (list === undefined) byProject.set(name, (list = []))
@@ -1557,7 +1558,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
         (s) => s.globs,
         (s) => s.reads,
       )) {
-        readsOutputs(sides[i]!, sides[j]!, 'files')
+        readsOutputs(memo, sides[i]!, sides[j]!, 'files')
       }
     }
   }
@@ -1575,7 +1576,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       (s) => s.globs,
       (s) => s.reads,
     )) {
-      readsOutputs(sides[i]!, sides[j]!, 'files')
+      readsOutputs(memo, sides[i]!, sides[j]!, 'files')
     }
   }
   if (!rootReaders) return
@@ -1593,26 +1594,63 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     (s) => s.globs,
     (s) => s.reads,
   )) {
-    readsOutputs(rooted[i]!, rooted[j]!, 'workspaceFiles')
+    readsOutputs(memo, rooted[i]!, rooted[j]!, 'workspaceFiles')
   }
 }
 
-function readsOutputs(x: Side, y: Side, field: 'files' | 'workspaceFiles'): void {
+/**
+ * Whether a reader's take-back list covers an output glob, asked once per
+ * list and glob: a Turbo-mapped repo gives two thousand readers one
+ * 400-entry list, and asking it per reader and writer pair was 2.7 s of an
+ * astro plan (2026-10-09). One per `detectInputOverlaps` call.
+ */
+interface TakeBack {
+  list: string[]
+  verdicts: Map<string, boolean>
+}
+type TakeBackMemo = { bySide: Map<Side, TakeBack>; byList: Map<string, TakeBack> }
+
+function takenBack(
+  memo: TakeBackMemo,
+  reader: Side,
+  field: 'files' | 'workspaceFiles',
+  go: string,
+): boolean {
+  let tb = memo.bySide.get(reader)
+  if (tb === undefined) {
+    const cache = reader.node.config.cache!
+    // A reader rebased to the root (X-135) speaks in its project's terms.
+    const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
+    // What the reader's key never reads: its `!` entries and its own outputs.
+    const list = [
+      ...splitNegations(
+        field === 'files' ? cache.inputs.files : (cache.inputs.workspaceFiles ?? []),
+      ).negative,
+      ...splitNegations(
+        field === 'files' ? cache.outputs.files : (cache.outputs.workspaceFiles ?? []),
+      ).positive,
+    ].map((g) => at + g)
+    const key = list.join('\0')
+    tb = memo.byList.get(key)
+    if (tb === undefined) memo.byList.set(key, (tb = { list, verdicts: new Map() }))
+    memo.bySide.set(reader, tb)
+  }
+  let verdict = tb.verdicts.get(go)
+  if (verdict === undefined) tb.verdicts.set(go, (verdict = outputTakenBack(go, tb.list)))
+  return verdict
+}
+
+function readsOutputs(
+  memo: TakeBackMemo,
+  x: Side,
+  y: Side,
+  field: 'files' | 'workspaceFiles',
+): void {
   if (x.reads === y.reads || x.node === y.node) return
   const [reader, writer] = x.reads ? [x, y] : [y, x]
-  const cache = reader.node.config.cache!
-  // A reader rebased to the root (X-135) speaks in its project's terms.
   const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
-  // What the reader's key never reads: its `!` entries and its own outputs.
-  const takeBack = [
-    ...splitNegations(field === 'files' ? cache.inputs.files : (cache.inputs.workspaceFiles ?? []))
-      .negative,
-    ...splitNegations(
-      field === 'files' ? cache.outputs.files : (cache.outputs.workspaceFiles ?? []),
-    ).positive,
-  ].map((g) => at + g)
   for (const go of writer.globs) {
-    if (outputTakenBack(go, takeBack)) continue
+    if (takenBack(memo, reader, field, go)) continue
     for (const gi of reader.globs) {
       if (!outputsOverlap(gi, go)) continue
       const shown =

package/src/orchestrator/metrics.ts

@@ -610,10 +610,17 @@ export interface CacheKeyDiff {
   note: string
 }
 
-function loadEntryInputs(db: Database, entryHash: string): TaskInputComponent[] {
-  return db
-    .query('SELECT kind, name, hash FROM entry_inputs WHERE entry_hash = ?')
-    .all(entryHash) as TaskInputComponent[]
+/** An entry's key components, from its one `entry_inputs` row (v34); none when it has none. */
+export function loadEntryInputs(db: Database, entryHash: string): TaskInputComponent[] {
+  const row = db
+    .query('SELECT components FROM entry_inputs WHERE entry_hash = ?')
+    .get(entryHash) as { components: string } | null
+  if (row === null) return []
+  return (JSON.parse(row.components) as [string, string, string][]).map(([kind, name, hash]) => ({
+    kind,
+    name,
+    hash,
+  }))
 }
 
 /**