@vzn/vx 0.0.633 → 0.0.635

package/src/graph/task-graph.ts

@@ -302,6 +302,7 @@ export interface BuildGraphOptions {
 export function undeclaredDepsError(taskId: string, name: string): UserError {
   return new UserError(
     `Task ${taskId} depends on ^${name} but no project in the workspace declares ${name}`,
+    'VX_E_DEPENDS_ON',
   )
 }
 
@@ -492,7 +493,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
       spec = parseDependencySpec(raw)
     } catch (err) {
       if (err instanceof DependencySpecError) {
-        throw new UserError(`Task ${id}: ${err.message}`)
+        throw new UserError(`Task ${id}: ${err.message}`, 'VX_E_DEPENDS_ON')
       }
       throw err
     }
@@ -503,14 +504,21 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
     // operations. PARTIAL patterns (`build.*`, `^build.*`) are legal:
     // they name a namespace of tasks to add (Nx 19.5 parity).
     if (spec.kind === 'wildcardSelf' || spec.kind === 'wildcardDeps') {
-      throw new UserError(`Task ${id}: dependsOn does not accept bare wildcards (got "${raw}")`)
+      throw new UserError(
+        `Task ${id}: dependsOn does not accept bare wildcards (got "${raw}")`,
+        'VX_E_DEPENDS_ON',
+      )
     }
     if (spec.negated) {
-      throw new UserError(`Task ${id}: dependsOn does not accept negation (got "${raw}")`)
+      throw new UserError(
+        `Task ${id}: dependsOn does not accept negation (got "${raw}")`,
+        'VX_E_DEPENDS_ON',
+      )
     }
     if (spec.kind === 'cross' && (isTaskPattern(spec.task) || isTaskPattern(spec.project))) {
       throw new UserError(
         `Task ${id}: dependsOn patterns are not supported in the "pkg#task" form (got "${raw}")`,
+        'VX_E_DEPENDS_ON',
       )
     }
     if (spec.kind === 'self') {
@@ -530,6 +538,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
         if (!visit(frame, projectName, spec.task, false)) {
           throw new UserError(
             `Task ${id} depends on ${taskId(projectName, spec.task)} but no such task is declared`,
+            'VX_E_DEPENDS_ON',
           )
         }
         goPast(frame, projectName, spec.task, new Set([projectName]))
@@ -594,9 +603,11 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
         if (spec.project === '//')
           throw new UserError(
             `Task ${id} depends on //#${spec.task}, Turbo's root package, but the workspace root is no project here: give it a package.json name and a vx.config with that task`,
+            'VX_E_DEPENDS_ON',
           )
         throw new UserError(
           `Task ${id} depends on ${taskId(spec.project, spec.task)} but no such project or task is declared`,
+          'VX_E_DEPENDS_ON',
         )
       }
       goPast(frame, spec.project, spec.task, new Set([projectName, spec.project]))
@@ -1109,7 +1120,7 @@ function collideAcross(
         `cache.outputs.files — vx cleans a task's declared outputs before it runs and before a ` +
         `cache-hit restore, so whichever of these runs second DELETES the other's output`
       if (exclusive && (reaches(files.id, ws.id) || reaches(ws.id, files.id))) {
-        throw new UserError(`${head}. ${EXCLUSIVE_OUTPUTS_FIX}`)
+        throw new UserError(`${head}. ${EXCLUSIVE_OUTPUTS_FIX}`, 'VX_E_OUTPUT_OVERLAP')
       }
       if (reaches(files.id, ws.id)) {
         ;(files.addsToOutputsOf ??= []).push(ws.id)
@@ -1132,11 +1143,13 @@ function collideAcross(
           `${head}. ${ws.id} depends on ${files.id}, but adding to its output needs every ` +
             `cache.outputs.workspaceFiles entry inside ${rel === '' ? 'the workspace root' : rel}, ` +
             `and ${JSON.stringify(outside)} is not. Give each task its own output path.`,
+          'VX_E_OUTPUT_OVERLAP',
         )
       }
       throw new UserError(
         `${head} and the run still reports success. Give each task its own output path` +
           (exclusive ? '.' : ', or make one depend on the other.'),
+        'VX_E_OUTPUT_OVERLAP',
       )
     }
   }
@@ -1373,7 +1386,8 @@ function collide(
       // `rules.exclusiveOutputs` is off (X-53). Without an edge the two run
       // in either order, and the refusal below stands.
       const [up, down] = reaches(b.id, a.id) ? [a, b] : reaches(a.id, b.id) ? [b, a] : []
-      if (up !== undefined && exclusive) throw new UserError(`${head}. ${EXCLUSIVE_OUTPUTS_FIX}`)
+      if (up !== undefined && exclusive)
+        throw new UserError(`${head}. ${EXCLUSIVE_OUTPUTS_FIX}`, 'VX_E_OUTPUT_OVERLAP')
       if (up !== undefined && down !== undefined) {
         const downGlobs = splitNegations(
           (field === 'files'
@@ -1386,6 +1400,7 @@ function collide(
       }
       throw new UserError(
         `${head} and the run still reports success. Give each task its own output path.`,
+        'VX_E_OUTPUT_OVERLAP',
       )
     }
   }
@@ -1440,6 +1455,7 @@ function refuseSelfClean(node: TaskNode): void {
           `its own output — vx removes a task's outputs before it runs, so the task would ` +
           `delete its own sources. A task that rewrites files in place (a formatter) declares ` +
           `no outputs.`,
+        'VX_E_INPUT_IS_OUTPUT',
       )
     }
   }
@@ -1517,6 +1533,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   const filesWriters: TaskNode[] = []
   let projectReaders = false
   let rootReaders = false
+  const memo: TakeBackMemo = { bySide: new Map(), byList: new Map() }
   const bucket = (name: string): Side[] => {
     let list = byProject.get(name)
     if (list === undefined) byProject.set(name, (list = []))
@@ -1557,7 +1574,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
         (s) => s.globs,
         (s) => s.reads,
       )) {
-        readsOutputs(sides[i]!, sides[j]!, 'files')
+        readsOutputs(memo, sides[i]!, sides[j]!, 'files')
       }
     }
   }
@@ -1575,7 +1592,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       (s) => s.globs,
       (s) => s.reads,
     )) {
-      readsOutputs(sides[i]!, sides[j]!, 'files')
+      readsOutputs(memo, sides[i]!, sides[j]!, 'files')
     }
   }
   if (!rootReaders) return
@@ -1593,26 +1610,63 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     (s) => s.globs,
     (s) => s.reads,
   )) {
-    readsOutputs(rooted[i]!, rooted[j]!, 'workspaceFiles')
+    readsOutputs(memo, rooted[i]!, rooted[j]!, 'workspaceFiles')
   }
 }
 
-function readsOutputs(x: Side, y: Side, field: 'files' | 'workspaceFiles'): void {
+/**
+ * Whether a reader's take-back list covers an output glob, asked once per
+ * list and glob: a Turbo-mapped repo gives two thousand readers one
+ * 400-entry list, and asking it per reader and writer pair was 2.7 s of an
+ * astro plan (2026-10-09). One per `detectInputOverlaps` call.
+ */
+interface TakeBack {
+  list: string[]
+  verdicts: Map<string, boolean>
+}
+type TakeBackMemo = { bySide: Map<Side, TakeBack>; byList: Map<string, TakeBack> }
+
+function takenBack(
+  memo: TakeBackMemo,
+  reader: Side,
+  field: 'files' | 'workspaceFiles',
+  go: string,
+): boolean {
+  let tb = memo.bySide.get(reader)
+  if (tb === undefined) {
+    const cache = reader.node.config.cache!
+    // A reader rebased to the root (X-135) speaks in its project's terms.
+    const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
+    // What the reader's key never reads: its `!` entries and its own outputs.
+    const list = [
+      ...splitNegations(
+        field === 'files' ? cache.inputs.files : (cache.inputs.workspaceFiles ?? []),
+      ).negative,
+      ...splitNegations(
+        field === 'files' ? cache.outputs.files : (cache.outputs.workspaceFiles ?? []),
+      ).positive,
+    ].map((g) => at + g)
+    const key = list.join('\0')
+    tb = memo.byList.get(key)
+    if (tb === undefined) memo.byList.set(key, (tb = { list, verdicts: new Map() }))
+    memo.bySide.set(reader, tb)
+  }
+  let verdict = tb.verdicts.get(go)
+  if (verdict === undefined) tb.verdicts.set(go, (verdict = outputTakenBack(go, tb.list)))
+  return verdict
+}
+
+function readsOutputs(
+  memo: TakeBackMemo,
+  x: Side,
+  y: Side,
+  field: 'files' | 'workspaceFiles',
+): void {
   if (x.reads === y.reads || x.node === y.node) return
   const [reader, writer] = x.reads ? [x, y] : [y, x]
-  const cache = reader.node.config.cache!
-  // A reader rebased to the root (X-135) speaks in its project's terms.
   const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
-  // What the reader's key never reads: its `!` entries and its own outputs.
-  const takeBack = [
-    ...splitNegations(field === 'files' ? cache.inputs.files : (cache.inputs.workspaceFiles ?? []))
-      .negative,
-    ...splitNegations(
-      field === 'files' ? cache.outputs.files : (cache.outputs.workspaceFiles ?? []),
-    ).positive,
-  ].map((g) => at + g)
   for (const go of writer.globs) {
-    if (outputTakenBack(go, takeBack)) continue
+    if (takenBack(memo, reader, field, go)) continue
     for (const gi of reader.globs) {
       if (!outputsOverlap(gi, go)) continue
       const shown =
@@ -1625,6 +1679,7 @@ function readsOutputs(x: Side, y: Side, field: 'files' | 'workspaceFiles'): void
           `Exclude it: add ${JSON.stringify(`!${out}`)} to ${reader.node.id}'s ` +
           `cache.inputs.${field}, or set rules: { upfrontKeys: false } in vx.workspace.ts to ` +
           `let it wait for its producer.`,
+        'VX_E_INPUT_IS_OUTPUT',
       )
     }
   }

package/src/index.ts

@@ -65,7 +65,12 @@ export { run, planRun, prepareRun } from './orchestrator/index.js'
 // (`@vzn/vx-schedule-history` does; a plugin package reaches core only
 // through this façade, which is what put these here).
 export { LocalHistoryProvider } from './orchestrator/index.js'
-export type { HistoryProvider, HistoryTable, TaskHistory } from './orchestrator/index.js'
+export type {
+  HistoryProvider,
+  HistoryTable,
+  TaskHistory,
+  TaskResources,
+} from './orchestrator/index.js'
 export type { PreparedRun } from './orchestrator/index.js'
 // `RunOptions.affected`: what `--affected`'s diff changed, per project.
 export type { AffectedChanges } from './workspace/index.js'

package/src/orchestrator/execute-task.ts

@@ -78,6 +78,7 @@ import type { FingerprintWatch } from './fingerprint-watch.js'
 import { restoreHit } from './hit-restore.js'
 import type { MissExplainer } from './miss-reason.js'
 import { shellVerdict } from './shell-verdict.js'
+import { sandboxFix } from './sandbox-fix.js'
 // The hit path's entry stays importable from here (tests).
 export { restoreHit, type RestoreHitArgs } from './hit-restore.js'
 import type { DeferredOutputs } from './deferred-outputs.js'
@@ -336,6 +337,18 @@ async function restoreOrMiss(
   }
 }
 
+/**
+ * Does a write to an input during the command count as unchanged when it
+ * left the bytes the key folded (`movedInput`'s `writesByBytes`)? Only when
+ * the task says `compare`, or says nothing and `VX_REWRITTEN_INPUTS` is
+ * `compare`: by default any such write withholds the save, on CI too,
+ * since a concurrent task can change an input and put it back (owner,
+ * 2026-10-12).
+ */
+function rewritesByBytes(cache: CacheConfig | undefined): boolean {
+  return (cache?.rewrittenInputs ?? process.env['VX_REWRITTEN_INPUTS']) === 'compare'
+}
+
 /**
  * The workspace fingerprint every key here folded has moved (a task
  * rewrote the lockfile), said once per run.
@@ -1558,7 +1571,14 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
    */
   async function movedSinceKey(): Promise<string | null | undefined> {
     if (described!.hash !== hash) return null
-    return (await movedInput(described!.facts, cache, described!.describedAt)) ?? described!.added()
+    return (
+      (await movedInput(
+        described!.facts,
+        cache,
+        described!.describedAt,
+        rewritesByBytes(args.node.config.cache),
+      )) ?? described!.added()
+    )
   }
 
   /**
@@ -1608,6 +1628,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   }
 
   const finalViolations = violations
+  const fixOf = (fix: TaskOutcome['sandboxFix']) => (fix === undefined ? {} : { sandboxFix: fix })
 
   return {
     node,
@@ -1640,6 +1661,14 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
           sandboxViolations: finalViolations.filter((v) => v.hint !== true).length,
           // A denied path is the task's own spelling, a secret in it too.
           sandboxViolationLines: finalViolations.map((v) => secrets?.mask(v.line) ?? v.line),
+          ...fixOf(
+            sandboxFix(
+              finalViolations,
+              node.projectDir,
+              (t) => secrets?.mask(t) ?? t,
+              cacheCfg?.inputs.files,
+            ),
+          ),
         }
       : {}),
   }

package/src/orchestrator/framed-output.ts

@@ -32,6 +32,7 @@ import { paint, type ColorSupport } from './colors.js'
 import { neverStarted } from './summary.js'
 import { outcomeLabel, ranNoCache, skippedReason } from './events.js'
 import { fileMemo, linkPaths } from './path-links.js'
+import { sandboxFixLine } from './sandbox-fix.js'
 
 const NO_COLOR: ColorSupport = { enabled: false }
 
@@ -529,7 +530,32 @@ function violationSection(outcome: TaskOutcome, colors: ColorSupport): string[]
   // every record for telemetry.
   const body = [...new Set(vlines)]
   // Red, not amber: a violation fails the task, so it reads as a failure.
-  return [sectionLine(`SANDBOX VIOLATIONS (${body.length})`, ERROR, colors), '', ...body, '']
+  // vx's note, after the evidence: the grants that would have allowed it.
+  // A read the output depends on is a key input too; the sandbox never
+  // adds one (owner, 2026-10-09).
+  const fix = outcome.sandboxFix
+  const line = fix === undefined ? undefined : sandboxFixLine(fix)
+  const dim = (text: string): string => paint('', text, colors, { dim: true })
+  const note =
+    fix === undefined
+      ? []
+      : [
+          ...(line !== undefined ? [dim(`fix: ${line}`)] : []),
+          ...(fix.read !== undefined
+            ? [dim('a read the output depends on belongs in cache.inputs.files too')]
+            : []),
+          ...(fix.withheld !== undefined
+            ? [dim(`credential path, grant it only on purpose: ${fix.withheld.join(', ')}`)]
+            : []),
+          '',
+        ]
+  return [
+    sectionLine(`SANDBOX VIOLATIONS (${body.length})`, ERROR, colors),
+    '',
+    ...body,
+    '',
+    ...note,
+  ]
 }
 
 export function formatFrameClose(

package/src/orchestrator/history.ts

@@ -21,7 +21,8 @@ const DEFAULT_RECENT = 50
 
 // A hit is recorded as `cache-hit` / `cache-hit-remote` and replays a
 // success; the list is derived so a new status cannot miss it.
-const PASS_STATUSES = `(${TASK_STATUSES.filter(isPassStatus)
+/** The pass set as SQL, `(…)`: one definition, `isPassStatus`. */
+export const PASS_STATUSES = `(${TASK_STATUSES.filter(isPassStatus)
   .map((s) => `'${s}'`)
   .join(', ')})`
 
@@ -58,6 +59,12 @@ export interface TaskHistory {
 /** Map keyed by `project#task`. */
 export type HistoryTable = ReadonlyMap<string, TaskHistory>
 
+/** What a scheduler learns from a task's history: its p50 and its resource maxima. */
+export type TaskResources = Pick<
+  TaskHistory,
+  'p50DurationMs' | 'maxPeakRssBytes' | 'maxCpuParallelism'
+>
+
 export interface HistoryProvider {
   loadFor(taskIds: readonly string[]): Promise<HistoryTable>
   /**
@@ -213,6 +220,73 @@ export class LocalHistoryProvider implements HistoryProvider {
     return out
   }
 
+  /**
+   * `loadFor`'s p50 and resource maxima over the same window, without its
+   * rates. The rates group every row of the window and join each hit to
+   * its entry: 407 ms at 168,000 rows (8,002 tasks, 21 runs), most of a
+   * nothing-changed run's schedule stage. Here the executed successes are
+   * grouped alone, and the hits only as distinct keys, each joined to its
+   * entry once: 148 ms on the same table, the same numbers.
+   */
+  async resourcesFor(taskIds: readonly string[]): Promise<ReadonlyMap<string, TaskResources>> {
+    const out = new Map<string, TaskResources>()
+    if (taskIds.length === 0) return out
+    const floor = this.floor()
+    const wanted = new Set(taskIds)
+    type Executed = {
+      project: string
+      task: string
+      ds: string
+      rss: number | null
+      cpu: number | null
+    }
+    const executed = this.db
+      .query(
+        `SELECT project, task, GROUP_CONCAT(duration_ms) AS ds, MAX(peak_rss_bytes) AS rss,
+           MAX(CASE WHEN cpu_ms IS NOT NULL AND duration_ms > 0
+                    THEN cpu_ms * 1.0 / duration_ms END) AS cpu
+         FROM runs
+         WHERE id >= ? AND status = 'success' AND (cache_hit IS NULL OR cache_hit = 0)
+         GROUP BY project, task`,
+      )
+      .all(floor) as Executed[]
+    for (const row of executed) {
+      const key = `${row.project}#${row.task}`
+      if (!wanted.has(key)) continue
+      const durations = row.ds.split(',').map(Number)
+      durations.sort((a, b) => a - b)
+      out.set(key, {
+        p50DurationMs: pickPercentile(durations, 0.5),
+        ...(row.rss !== null ? { maxPeakRssBytes: row.rss } : {}),
+        ...(row.cpu !== null ? { maxCpuParallelism: row.cpu } : {}),
+      })
+    }
+    type Hit = { project: string; task: string; rss: number | null; cpu: number | null }
+    const hits = this.db
+      .query(
+        `SELECT h.project, h.task, MAX(e.peak_rss_bytes) AS rss,
+           MAX(CASE WHEN e.cpu_ms IS NOT NULL AND e.duration_ms > 0
+                    THEN e.cpu_ms * 1.0 / e.duration_ms END) AS cpu
+         FROM (SELECT DISTINCT project, task, hash FROM runs WHERE id >= ? AND cache_hit = 1) h
+         JOIN entries e ON e.hash = h.hash
+         GROUP BY h.project, h.task`,
+      )
+      .all(floor) as Hit[]
+    for (const row of hits) {
+      const key = `${row.project}#${row.task}`
+      if (!wanted.has(key) || (row.rss === null && row.cpu === null)) continue
+      const had = out.get(key)
+      const rss = Math.max(had?.maxPeakRssBytes ?? -Infinity, row.rss ?? -Infinity)
+      const cpu = Math.max(had?.maxCpuParallelism ?? -Infinity, row.cpu ?? -Infinity)
+      out.set(key, {
+        p50DurationMs: had?.p50DurationMs,
+        ...(rss !== -Infinity ? { maxPeakRssBytes: rss } : {}),
+        ...(cpu !== -Infinity ? { maxCpuParallelism: cpu } : {}),
+      })
+    }
+    return out
+  }
+
   /** The first `runs` id of the newest `recent` invocations (see `loadFor`). */
   private floor(): number {
     const row = this.db

package/src/orchestrator/index.ts

@@ -56,6 +56,7 @@ export {
   type HistoryTable,
   LocalHistoryProvider,
   type TaskHistory,
+  type TaskResources,
 } from './history.js'
 export {
   detectFlaky,

package/src/orchestrator/path-links.ts

@@ -35,7 +35,9 @@ export function linkPaths(text: string, dir: string, isFile: (abs: string) => bo
 
 /**
  * The files `text` names that exist (resolved against `dir`), each with the
- * line and column it gave, unique, in order of first appearance.
+ * line and column it gave, unique, in order of first appearance. A file also
+ * named with a line drops its bare mention: bun test heads a failure with
+ * `app.test.js:` and gives the line only in the stack below it.
  */
 export function fileLocations(
   text: string,
@@ -56,9 +58,9 @@ export function fileLocations(
       ...(line !== undefined ? { line: Number(line) } : {}),
       ...(col !== undefined ? { col: Number(col) } : {}),
     })
-    if (out.length === LOCATIONS_CAP) break
   }
-  return out
+  const lined = new Set(out.filter((l) => l.line !== undefined).map((l) => l.file))
+  return out.filter((l) => l.line !== undefined || !lined.has(l.file)).slice(0, LOCATIONS_CAP)
 }
 
 /** A file test that asks the file system once per path. */

package/src/orchestrator/plugin.ts

@@ -127,7 +127,9 @@ export interface VxPlugin {
   /**
    * Scheduling priorities: task id → weight, higher runs first among READY
    * tasks (merged over the structural baseline, which stays the tie-break).
-   * Runs once, after the graph is final. A later plugin's weight for a task
+   * Runs once, after the graph is final and the local hits are known, and
+   * only when a task will start: a run of confirmed local hits restores
+   * in no order a weight changes. A later plugin's weight for a task
    * overrides an earlier one's. Return undefined to leave the baseline.
    */
   schedule?(

package/src/orchestrator/prepare.ts

@@ -102,9 +102,11 @@ export interface PreparedRun {
   /**
    * Scheduling priorities from plugins' `schedule` stage (task id → weight,
    * merged over the structural baseline by the scheduler). Empty when no
-   * plugin declares the stage.
+   * plugin declares the stage. Asked only by a run with a task to start:
+   * the stage reads history (148 ms at 8,002 tasks) to order work a
+   * nothing-changed run never dispatches. Runs the stage once.
    */
-  priorities: ReadonlyMap<string, number>
+  priorities: () => Promise<ReadonlyMap<string, number>>
   nodes: Map<string, TaskNode>
   /**
    * The tasks `--exclude-dependencies` took out of the schedule: keyed as a
@@ -491,7 +493,7 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
       localCache,
       hasRemoteLayer,
       cachePolicy: policy,
-      priorities: new Map(),
+      priorities: () => Promise.resolve(new Map()),
       nodes: new Map(),
       keyOnly: new Map(),
       unresolvedTasks,
@@ -687,15 +689,16 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
         })
       }
     }
-    let priorities: ReadonlyMap<string, number> = new Map()
-    if (hasHook(plugins, 'schedule')) {
-      priorities = await applyScheduleHooks(plugins, nodes, {
-        workspaceRoot,
-        cacheDir,
-        warn: (m) => log.status(m),
-        localCache,
-      })
-    }
+    let scheduled: Promise<ReadonlyMap<string, number>> | undefined
+    const priorities = (): Promise<ReadonlyMap<string, number>> =>
+      (scheduled ??= hasHook(plugins, 'schedule')
+        ? applyScheduleHooks(plugins, nodes, {
+            workspaceRoot,
+            cacheDir,
+            warn: (m) => log.status(m),
+            localCache,
+          })
+        : Promise.resolve(new Map()))
 
     return {
       workspaceRoot,

package/src/orchestrator/remote-prefetch.ts

@@ -113,11 +113,17 @@ async function runPrefetch(args: PrefetchArgs): Promise<void> {
  */
 export function getContext(node: TaskNode, command: string) {
   const outputs = node.config.cache?.outputs
+  let masked: string | undefined
   return {
     taskId: node.id,
     // Stored in the entry row a remote hit inserts: masked as a save's is,
-    // or the token a config inlined sat in cache.db (L-27).
-    command: maskedCommand(command, node.config.exec?.env),
+    // or the token a config inlined sat in cache.db (L-27). Masked on the
+    // first read: only an adopt or a remote hit reads it, and masking every
+    // lookup's command cost a cold 1,090-package run ~20 ms before its
+    // first task.
+    get command() {
+      return (masked ??= maskedCommand(command, node.config.exec?.env))
+    },
     outputs: { files: outputs?.files ?? [], workspaceFiles: outputs?.workspaceFiles ?? [] },
   }
 }

package/src/orchestrator/run-failures.ts

@@ -9,6 +9,7 @@ import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync
 import path from 'node:path'
 import { isGroupTask, type TaskOutcome } from '../graph/index.js'
 import { decodeOutputLog } from './output-log.js'
+import { PASS_STATUSES } from './history.js'
 import { splitTaskId } from '../util/index.js'
 import { fileLocations, fileMemo, type OutputLocation } from './path-links.js'
 
@@ -23,6 +24,10 @@ export interface TaskFailure {
   /** Plain text, bounded, secrets masked; '' when the run kept none. */
   output: string
   locations: OutputLocation[]
+  /** The `exec.sandbox.allow` entries that would have granted its denials. */
+  sandboxFix?: NonNullable<TaskOutcome['sandboxFix']>
+  /** The first later run where this task passed (ran or hit): the failure is history. */
+  fixedIn?: string
 }
 
 export interface RunFailures {
@@ -56,6 +61,7 @@ function failuresOf(outcomes: readonly TaskOutcome[]): StoredFailure[] {
       ...(o.timedOut === true ? { timedOut: true as const } : {}),
       output,
       locations: fileLocations(output, o.node.projectDir, isFile),
+      ...(o.sandboxFix !== undefined ? { sandboxFix: o.sandboxFix } : {}),
     })
   }
   return out
@@ -110,10 +116,19 @@ export function runFailures(cacheDir: string, db: Database, runId?: string): Run
   }
   const rows = db
     .query(
-      `SELECT project, task, exit_code AS exitCode, timed_out AS timedOut FROM runs
-       WHERE run_id = ? AND status = 'failed' ORDER BY id`,
+      `SELECT r.project, r.task, r.exit_code AS exitCode, r.timed_out AS timedOut,
+         (SELECT s.run_id FROM runs s WHERE s.project = r.project AND s.task = r.task
+            AND s.id > r.id AND s.status IN ${PASS_STATUSES}
+          ORDER BY s.id LIMIT 1) AS fixedIn
+       FROM runs r WHERE r.run_id = ? AND r.status = 'failed' ORDER BY r.id`,
     )
-    .all(id) as { project: string; task: string; exitCode: number; timedOut: number | null }[]
+    .all(id) as {
+    project: string
+    task: string
+    exitCode: number
+    timedOut: number | null
+    fixedIn: string | null
+  }[]
   return {
     runId: id,
     tasks: rows.map((r) => {
@@ -125,6 +140,8 @@ export function runFailures(cacheDir: string, db: Database, runId?: string): Run
         ...(r.timedOut === 1 ? { timedOut: true as const } : {}),
         output: k?.output ?? '',
         locations: k?.locations ?? [],
+        ...(k?.sandboxFix !== undefined ? { sandboxFix: k.sandboxFix } : {}),
+        ...(r.fixedIn !== null ? { fixedIn: r.fixedIn } : {}),
       }
     }),
   }

package/src/orchestrator/run.ts

@@ -945,7 +945,15 @@ async function runOnBus(
     // shouldShortCircuit (local reads on, no remote layer); when off, both
     // maps are empty and the run is byte-identical.
     let shortCircuit: ShortCircuit = emptyShortCircuit()
-    if (shouldShortCircuit(nodes, policy, cache)) {
+    // An empty local cache answers every probe with a miss: each task
+    // derives its key as it starts instead (~100 ms before a cold 1,090-
+    // package run's first spawn), and every sandboxed task runs.
+    const coldLocal =
+      cache === prepared.localCache &&
+      shouldShortCircuit(nodes, policy, cache) &&
+      prepared.localCache.holdsNothing()
+    if (coldLocal) prewarm()
+    else if (shouldShortCircuit(nodes, policy, cache)) {
       shortCircuit = await startLocalShortCircuit({
         nodes,
         cache,
@@ -1081,6 +1089,14 @@ async function runOnBus(
     })
 
     mark('classify + probe')
+    // A run whose every task is a confirmed local hit dispatches only
+    // restores, which no weight orders: the `schedule` stage is not asked.
+    const priorities = [...nodes.values()].every(
+      (n) => n.config.exec?.command === undefined || shortCircuit.restoreTier.has(n.id),
+    )
+      ? new Map<string, number>()
+      : await prepared.priorities()
+    mark('schedule')
     // Judged as each task finishes, against the history BEFORE this run's
     // rows land, so the row that prints next carries the verdict: nothing
     // prints below the footer. A hit or a skip asks nothing; a green miss
@@ -1164,7 +1180,11 @@ async function runOnBus(
         : {}),
       // A `schedule` plugin's weights; the scheduler keeps its structural
       // baseline as the tie-break. Empty map → baseline only.
-      ...(prepared.priorities.size > 0 ? { priorities: prepared.priorities } : {}),
+      ...(priorities.size > 0 ? { priorities } : {}),
+      // The baseline under them; `most-work` when the workspace names none.
+      ...(prepared.workspaceConfig?.schedule !== undefined
+        ? { strategy: prepared.workspaceConfig.schedule }
+        : {}),
       // Local short-circuit: confirmed stable local hits the scheduler
       // runs ahead of their deps as low-priority worker-slot backfill.
       // Empty when the short-circuit didn't fire → byte-identical.
@@ -1706,6 +1726,8 @@ export async function planRun(options: RunOptions): Promise<RunPlan> {
     if (prepared.empty === 'none-affected')
       return { tasks: [], noneAffected: noneAffected(prepared, options) }
     if (prepared.empty !== null) return { tasks: [] }
+    // The plan orders nothing, but it refuses what the run would refuse.
+    await prepared.priorities()
     // Its own mark: a dry run's plan (every task's hash, the cache lookups,
     // the history p50s) was booked under `close`, the next mark, and read
     // as 105 ms of closing a cache at 1,000 projects (item 601).