@vzn/vx 0.0.635 → 0.0.637

package/src/orchestrator/execute-task.ts

@@ -1,11 +1,13 @@
 import path from 'node:path'
-import type { ExecConfig, TaskConfig, CacheConfig } from '../config.js'
+import type { ExecConfig, TaskConfig, CacheConfig, InputStability } from '../config.js'
 import {
   ArtifactVanishedError,
   type CacheEntry,
   type CacheLayer,
   type CachePolicy,
+  anyUntouched,
   cleanOutputs,
+  committedFiles,
   cleanWorkspaceOutputs,
   type OutputStamp,
   ownOutputsSince,
@@ -14,6 +16,7 @@ import {
   stampWorkspaceOutputs,
   FULL_CACHE_POLICY,
   type GitFilesCache,
+  racyWindowMs,
 } from '../cache/index.js'
 import {
   buildIsolatedEnv,
@@ -51,7 +54,9 @@ import { isGroupTask, RestoreDemoted, type TaskNode, type TaskOutcome } from '..
 import {
   killGraceMs,
   MASKED,
+  parseDuration,
   maskedEmitter,
+  outputMatcher,
   printable,
   relPosix,
   secretMask,
@@ -61,12 +66,15 @@ import {
 } from '../util/index.js'
 import { forwardedSignal, SIGNAL_SHUTDOWN_GRACE_MS, terminateChildren } from './signals.js'
 import { executorLabel, nameExecutorFailure } from './plugin-host.js'
+import type { CommandWindows } from './command-windows.js'
 import {
+  commandWriteReach,
   mayWriteFingerprint,
   type Placeholder,
   placeholderSweeper,
   reachedWithheld,
   sandboxRequestFor,
+  sandboxReadable,
   sweepPlaceholders,
   undeclaredWriteReach,
   untouchedPlaceholderLine,
@@ -88,6 +96,7 @@ import {
   computeTaskHash,
   describeTaskInputs,
   type HashCache,
+  type InputFact,
   movedInput,
   type TaskInputComponent,
   type UpfrontGroupKey,
@@ -99,7 +108,6 @@ export interface ExecuteArgs {
   node: TaskNode
   upstream: TaskOutcome[]
   workspaceRoot: string
-  workspaceFingerprint: string
   cache: CacheLayer
   /** Granular cache read/write policy. Undefined → everything on. */
   cachePolicy?: CachePolicy
@@ -121,7 +129,7 @@ export interface ExecuteArgs {
    */
   remoteOnly?: boolean
   /**
-   * Plan-time `--download` decision for THIS task (run.ts). `'deferred'`
+   * Plan-time `--cache-download` decision for THIS task (run.ts). `'deferred'`
    * means: do not clean, do not save — the executor is expected to leave
    * the outputs in the remote store and hand back a closure. An executor
    * that ignores it and materialises anyway simply gets no local entry;
@@ -163,21 +171,29 @@ export interface ExecuteArgs {
   /** Name what a missed key changed (`createMissExplainer`); absent when nobody listens. */
   explainMiss?: MissExplainer
   /**
-   * Run-level retry default (`--retry <n>` / `RunOptions.retries`).
+   * Run-level retry default (`--retries <n>` / `RunOptions.retries`).
    * Explicit `exec.retries` wins, including an explicit 0. Threaded as
    * an option only — never folded into any hash, so cache keys are
    * byte-identical with and without it.
    */
   retries?: number
   /**
-   * Run-level default task timeout (ms) — the already-resolved
-   * `VX_TASK_TIMEOUT`/workspace/`--timeout` fallback. Per-task
-   * `exec.timeout` wins. Threaded as an option only — never hashed.
+   * `run.timeout` (ms), already resolved from flag, variable and
+   * workspace. Per-task `exec.timeout` wins. Never hashed.
    */
   timeout?: number
+  /** `run.readyNotice` (ms), resolved like `timeout`; unset, 10 s. */
+  readyNotice?: number
+  /**
+   * The run's `inputStability` layers around the task's own: `run` from
+   * the env vars (above the task), `workspace` from `.vx/workspace` (below).
+   */
+  inputStability?: { run: InputStability; workspace?: InputStability }
+  /** `cache.outputs.clean` for tasks without their own: its variable, else `.vx/workspace`. */
+  cleanOutputs?: boolean
   /** Per-run memo for `git ls-files` (one entry per project dir). */
   gitFilesCache?: GitFilesCache
-  /** Per-run memo for derived hashes (package.json bytes + task config). */
+  /** Per-run memo for derived hashes (task config, file lists). */
   hashCache?: HashCache
   /** The run's `probesAfterWrites`, handed to every key this task takes. */
   probesAfterWrites?: ReadonlySet<string>
@@ -242,8 +258,8 @@ export interface ExecuteArgs {
    */
   taintedUpstream?: boolean
   /**
-   * Whether a task has rewritten a file the workspace fingerprint folded
-   * since the run read it (fingerprint-watch.ts): past that, no key taken
+   * Whether a task has rewritten a root file a plugin claims (whose bytes
+   * the claimant folded) since the run read it (fingerprint-watch.ts): past that, no key taken
    * on the old digest is probed or saved.
    */
   fingerprintWatch?: FingerprintWatch
@@ -255,6 +271,8 @@ export interface ExecuteArgs {
   noDependants?: true
   /** The task holds vx's terminal (`terminalHolders`): its stdio is vx's own. */
   terminal?: true
+  /** When each command of the run ran and where it may write (command-windows.ts). */
+  commandWindows?: CommandWindows
 }
 
 /**
@@ -338,20 +356,31 @@ async function restoreOrMiss(
 }
 
 /**
- * Does a write to an input during the command count as unchanged when it
- * left the bytes the key folded (`movedInput`'s `writesByBytes`)? Only when
- * the task says `compare`, or says nothing and `VX_REWRITTEN_INPUTS` is
- * `compare`: by default any such write withholds the save, on CI too,
- * since a concurrent task can change an input and put it back (owner,
- * 2026-10-12).
+ * What a write to an input during the command means, each field highest
+ * first: the env var (`layers.run`), the task's `cache.inputStability`,
+ * the workspace's, then `'immutable'` and `'warn'` (owner, 2026-10-12), so
+ * by default any such write withholds the save, on CI too, since a
+ * concurrent task can change an input and put it back.
  */
-function rewritesByBytes(cache: CacheConfig | undefined): boolean {
-  return (cache?.rewrittenInputs ?? process.env['VX_REWRITTEN_INPUTS']) === 'compare'
+function inputStabilityOf(
+  cache: CacheConfig | undefined,
+  layers: ExecuteArgs['inputStability'],
+): Required<InputStability> {
+  const task = cache?.inputStability
+  return {
+    strategy: layers?.run.strategy ?? task?.strategy ?? layers?.workspace?.strategy ?? 'immutable',
+    severity: layers?.run.severity ?? task?.severity ?? layers?.workspace?.severity ?? 'warn',
+  }
+}
+
+/** The root files the plugins claim, as the run's watch holds them. */
+function claimedFiles(args: ExecuteArgs): readonly string[] {
+  return args.fingerprintWatch?.names ?? []
 }
 
 /**
- * The workspace fingerprint every key here folded has moved (a task
- * rewrote the lockfile), said once per run.
+ * A claimed file every key here folded through its claimant has moved (a
+ * task rewrote the lockfile), said once per run.
  */
 function fingerprintMoved(args: ExecuteArgs): boolean {
   if (args.fingerprintWatch?.moved() === undefined) return false
@@ -379,7 +408,6 @@ async function executeGroupTask(args: ExecuteArgs): Promise<TaskOutcome> {
     node: args.node,
     upstream: args.upstream,
     workspaceRoot: args.workspaceRoot,
-    workspaceFingerprint: args.workspaceFingerprint,
     cache: args.cache,
     forwardArgs: args.forwardArgs,
     nestedProjectDirs: args.nestedProjectDirs,
@@ -475,7 +503,6 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
           node,
           upstream: args.upstream,
           workspaceRoot: args.workspaceRoot,
-          workspaceFingerprint: args.workspaceFingerprint,
           cache: args.cache,
           forwardArgs: args.forwardArgs,
           nestedProjectDirs: args.nestedProjectDirs,
@@ -537,6 +564,8 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const serverSecrets = secretMask([process.env, env, step.env?.define], step.env?.secret)
   const serverOut = serverSecrets && maskedEmitter(serverSecrets, (t) => log.taskStdout(node, t))
   const serverErr = serverSecrets && maskedEmitter(serverSecrets, (t) => log.taskStderr(node, t))
+  // A server writes until the run stops it: its window stays open.
+  args.commandWindows?.open(node.id, node.projectDir, commandWriteReach(node, args.workspaceRoot))
   const persistentOpts: Parameters<typeof runPersistent>[0] = {
     command,
     cwd: node.projectDir,
@@ -555,7 +584,7 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
   }
   // For a persistent task the timeout bounds the readiness wait. Per-task
   // `exec.timeout` wins; else the run-level default (env/workspace/--timeout).
-  const effectiveTimeout = step.timeout ?? args.timeout
+  const effectiveTimeout = taskTimeoutMs(step) ?? args.timeout
   if (effectiveTimeout !== undefined) {
     persistentOpts.timeoutMs = effectiveTimeout
   }
@@ -606,7 +635,8 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
   // it fails, and with no `exec.timeout` the wait never ends, so a run
   // whose `readyWhen` never matched showed nothing at all.
   const readyWhen = step.persistent.readyWhen
-  const noticeMs = readyNoticeMs()
+  // How long a server may take to match `readyWhen` before vx says it waits.
+  const noticeMs = args.readyNotice ?? 10_000
   const notice =
     readyWhen === undefined
       ? undefined
@@ -649,7 +679,7 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
     const message = err instanceof Error ? err.message : String(err)
     // The task's OWN stream, not the process's: the frame is where a
     // reader looks for why a task failed, and a run with a custom logger
-    // (an embedder, the MCP server) never saw a bare stderr write at all.
+    // (an embedder) never saw a bare stderr write at all.
     log.taskStderr(node, `\n[vx] ${node.id}: persistent task failed to become ready: ${message}\n`)
     // A server is never traced, so the sandbox's refusals reach no report:
     // a dev server that died on a file outside its grants read only as the
@@ -713,7 +743,9 @@ async function executePersistentTask(args: ExecuteArgs): Promise<TaskOutcome> {
   }
   args.persistentRegistry?.set(node.id, spawn.child)
   forgetUndeclaredWrites(args, undeclaredWriteReach(node, args.workspaceRoot))
-  if (mayWriteFingerprint(node, args.workspaceRoot)) args.fingerprintWatch?.wrote()
+  if (mayWriteFingerprint(node, args.workspaceRoot, claimedFiles(args))) {
+    args.fingerprintWatch?.wrote()
+  }
   return {
     node,
     status: 'success',
@@ -784,10 +816,9 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const outputs = cacheCfg?.outputs.files ?? []
   const wsOutputs = cacheCfg?.outputs.workspaceFiles ?? []
   const effectiveForwardArgs = node.requested ? (args.forwardArgs ?? []) : []
-  // Timeout precedence: per-task `exec.timeout` → run-level default
-  // (`--timeout`/`RunOptions.timeout` → `VX_TASK_TIMEOUT` → workspace
-  // `timeout`, already collapsed into `args.timeout` by run.ts).
-  const effectiveTimeout = step.timeout ?? args.timeout
+  // Per-task `exec.timeout` beats `run.timeout` (flag, variable,
+  // workspace; resolved into `args.timeout` by run.ts).
+  const effectiveTimeout = taskTimeoutMs(step) ?? args.timeout
   // `signal` stops a plugin executor on the run's stop AND on
   // `exec.timeout`: core cannot kill a process an executor spawned, so a
   // declared timeout meant nothing on one that kept its own clock (H-12).
@@ -899,7 +930,6 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       node,
       upstream,
       workspaceRoot: args.workspaceRoot,
-      workspaceFingerprint: args.workspaceFingerprint,
       cache,
       forwardArgs: args.forwardArgs,
       nestedProjectDirs: args.nestedProjectDirs,
@@ -930,8 +960,13 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     projectDir: node.projectDir,
     outputs,
     nestedProjectDirs: args.nestedProjectDirs,
+    committed: committedFiles(args.gitFilesCache, node.projectDir),
+  }
+  const wsCleanArgs = {
+    workspaceRoot: args.workspaceRoot,
+    outputs: wsOutputs,
+    committed: committedFiles(args.gitFilesCache, args.workspaceRoot),
   }
-  const wsCleanArgs = { workspaceRoot: args.workspaceRoot, outputs: wsOutputs }
   // An ADDITIVE task (its outputs overlap an upstream's, with the edge that
   // orders them; item 588) does not clean by glob — the glob selects the
   // upstream's files it adds beside. Its outputs are stamped once before
@@ -941,6 +976,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const additive = (node.addsToOutputsOf?.length ?? 0) > 0
   let stampedBefore: ReadonlyMap<string, OutputStamp> | undefined
   let wsStampedBefore: ReadonlyMap<string, OutputStamp> | undefined
+  // `cache.outputs.clean: false` leaves the outputs to the first attempt's
+  // command, stamped, so a save can tell what it found and never wrote.
+  // An additive task never cleans by glob anyway.
+  const keepOutputs = !additive && (cacheCfg?.outputs.clean ?? args.cleanOutputs ?? true) === false
+  let keptBefore: ReadonlyMap<string, OutputStamp> | undefined
+  let wsKeptBefore: ReadonlyMap<string, OutputStamp> | undefined
 
   // Cache lookup. On hit, time the user-perceived restore op
   // (clean+restore+log-replay) — that's what the framed-block footer
@@ -979,7 +1020,6 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         node,
         upstream,
         workspaceRoot: args.workspaceRoot,
-        workspaceFingerprint: args.workspaceFingerprint,
         cache,
         forwardArgs: args.forwardArgs,
         nestedProjectDirs: args.nestedProjectDirs,
@@ -991,6 +1031,41 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
           : {}),
       })
     : undefined
+  /** The other command that may have put a moved input back (`ownRewrite`). */
+  let rewroteBy: string | undefined
+  /**
+   * Under `'mutable'`, a write during the command that left the key's bytes
+   * is the task's own identical rewrite only if no other command that may
+   * write the file ran between the describe and that write: one that did
+   * may have changed it and put it back while this command read it.
+   */
+  const ownRewrite = (file: string, ctimeMs: number): boolean => {
+    rewroteBy = args.commandWindows?.writerDuring(
+      node.id,
+      file,
+      described!.describedAt,
+      ctimeMs + racyWindowMs(ctimeMs, 0),
+    )
+    return rewroteBy === undefined
+  }
+
+  /**
+   * A committed file under the task's own outputs is keyed (`committedFiles`)
+   * and the task may rewrite it (TanStack Router's `routeTree.gen.ts`): the
+   * bytes it leaves are an output the entry saves and a restore writes, and
+   * they follow from the key, so their change is no moved input.
+   */
+  const ownOutput = outputs.length === 0 ? undefined : outputMatcher(outputs)
+  const ownWsOutput = wsOutputs.length === 0 ? undefined : outputMatcher(wsOutputs)
+  const keyedInputs = (facts: readonly InputFact[]): readonly InputFact[] =>
+    ownOutput === undefined && ownWsOutput === undefined
+      ? facts
+      : facts.filter(
+          (f) =>
+            ownOutput?.(relPosix(node.projectDir, f.path)) !== true &&
+            ownWsOutput?.(relPosix(args.workspaceRoot, f.path)) !== true,
+        )
+
   // A name only `exec.env.secret` makes secret is not one the name rule
   // sees later: its row carries the mark, so `vx why` hides its hash (M-63).
   const named = node.config.exec?.env?.secret
@@ -1050,7 +1125,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   let withheld: WithheldLink[] = []
 
   // Cache miss path (or caching disabled), up to `1 + retries` attempts.
-  // Explicit config wins over the run-level `--retry` default, including
+  // Explicit config wins over the run-level `--retries` default, including
   // an explicit `retries: 0`.
   const maxAttempts = 1 + (step.retries ?? args.retries ?? 0)
   let attempt = 0
@@ -1081,7 +1156,16 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       const endStamp = span('miss: stamp outputs')
       stampedBefore ??= await stampOutputs(cleanArgs)
       endStamp()
+    } else if (
+      keepOutputs &&
+      attempt === 1 &&
+      willWrite &&
+      !deferralRequested &&
+      outputs.length > 0
+    ) {
+      keptBefore = await stampOutputs(cleanArgs)
     } else if (willWrite && !deferralRequested && outputs.length > 0) {
+      keptBefore = undefined
       // Mark the wiped paths, exactly as the workspace twin below does. The
       // git snapshot still lists them with their committed index OIDs, and
       // resolveFiles SKIPS its existence probe for any path carrying a
@@ -1091,7 +1175,6 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       const endClean = span('miss: clean outputs')
       const cleanedRels = await cleanOutputs(cleanArgs)
       endClean()
-      args.gitFilesCache?.noteClean(node.id, node.projectDir, cleanedRels)
       args.gitFilesCache?.markOutputsChanged(node.projectDir, cleanedRels)
     }
     if (additive && willWrite && !deferralRequested && wsOutputs.length > 0) {
@@ -1099,7 +1182,16 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       // glob clean deleted the upstream's files before this task, which
       // reads them, ran (A-43).
       wsStampedBefore ??= await stampWorkspaceOutputs(wsCleanArgs)
+    } else if (
+      keepOutputs &&
+      attempt === 1 &&
+      willWrite &&
+      !deferralRequested &&
+      wsOutputs.length > 0
+    ) {
+      wsKeptBefore = await stampWorkspaceOutputs(wsCleanArgs)
     } else if (willWrite && !deferralRequested && wsOutputs.length > 0) {
+      wsKeptBefore = undefined
       // Root-anchored deletions can land in other projects' dirs; mark
       // them so stale per-project git snapshots can't survive the wipe.
       const cleanedWsRels = await cleanWorkspaceOutputs(wsCleanArgs)
@@ -1128,6 +1220,12 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     // the throw is its rejection, the value its resolution, so both reach
     // the naming catch and the cleanup in finally below.
     let running: Promise<unknown>
+    const closeWindow =
+      args.commandWindows?.open(
+        node.id,
+        node.projectDir,
+        commandWriteReach(node, args.workspaceRoot),
+      ) ?? (() => {})
     try {
       running = Promise.resolve(args.executor.execute(req))
     } catch (thrown) {
@@ -1166,6 +1264,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
         throw err
       })
       .finally(() => {
+        closeWindow()
         clearTimeout(timeoutTimer)
         unlistenStop?.()
         unlistenStop = undefined
@@ -1256,18 +1355,6 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       // The line quotes the command's first word, which a config may have
       // built from a secret: masked as the task's own output is (L-37).
       if (verdict !== undefined) log.taskStderr(node, `\n${secrets?.mask(verdict) ?? verdict}\n`)
-      // A committed file another task's clean removed, still gone: vx
-      // cleans outputs before a run where Turbo does not, so a reader with
-      // no edge to the producer fails naming only the file (A-48).
-      if (code !== 0) {
-        for (const c of (args.gitFilesCache?.trackedCleansMissing(node.id) ?? []).slice(0, 3)) {
-          const rel = relPosix(args.workspaceRoot, c.path)
-          log.taskStderr(
-            node,
-            `\n[vx] ${rel} is tracked by git, and ${c.by} removed it as an output before its run; it is still missing. A task that reads it needs dependsOn on ${c.by}.\n`,
-          )
-        }
-      }
     }
     return { result: res, exitCode: code }
   }
@@ -1316,7 +1403,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   const writeReach =
     args.executor.remote === true ? 'none' : undeclaredWriteReach(node, args.workspaceRoot)
   const writesFingerprint =
-    args.executor.remote !== true && mayWriteFingerprint(node, args.workspaceRoot)
+    args.executor.remote !== true &&
+    mayWriteFingerprint(node, args.workspaceRoot, claimedFiles(args))
   // A stop that landed during the awaits above (the key, the probe, the
   // input description): the first attempt would wipe the last build and
   // hand the executor a request after the run had stopped. Through a call,
@@ -1462,6 +1550,8 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
 
   const wallclockEndNs = process.hrtime.bigint() - args.runStartHrTimeNs
 
+  const stability = inputStabilityOf(args.node.config.cache, args.inputStability)
+  let movedFails: string | undefined
   let own: Awaited<ReturnType<typeof ownOutputs>>
   if (effectiveExitCode === 0 && willSave && deferralRequested) {
     // The outputs never landed here: no artifact, no rows. A partial local
@@ -1490,6 +1580,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   } else if (
     effectiveExitCode === 0 &&
     willSave &&
+    !leftBehind() &&
     (await keyStillTrue()) &&
     (own = await ownOutputs()) !== undefined
   ) {
@@ -1514,6 +1605,16 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       deferSave: args.deferSave,
       // A sink listens: say what the save cost.
       measure: args.explainMiss !== undefined,
+      ...(userSandbox
+        ? {
+            readable: sandboxReadable(
+              node,
+              cfg.exec!.sandbox!,
+              args.workspaceRoot,
+              args.nestedProjectDirs,
+            ),
+          }
+        : {}),
     })
     args.deferredSaves?.set(node.id, landed)
   } else if (cfgCacheable && !remoteOnly && !deferralRequested && args.noDependants !== true) {
@@ -1541,6 +1642,18 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     }
   }
 
+  /**
+   * A file the kept outputs held that the run left as it was: saving would
+   * file a leftover from an older build as this run's output, so nothing is
+   * saved (`cache.outputs.clean: false`).
+   */
+  function leftBehind(): boolean {
+    return (
+      (keptBefore !== undefined && anyUntouched(keptBefore)) ||
+      (wsKeptBefore !== undefined && anyUntouched(wsKeptBefore))
+    )
+  }
+
   /**
    * What an additive run saves as its own, or undefined when it removed a
    * file it found: no entry replays a removal (`ownOutputsSince`), so the
@@ -1573,10 +1686,10 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     if (described!.hash !== hash) return null
     return (
       (await movedInput(
-        described!.facts,
+        keyedInputs(described!.facts),
         cache,
         described!.describedAt,
-        rewritesByBytes(args.node.config.cache),
+        stability.strategy === 'mutable' ? ownRewrite : undefined,
       )) ?? described!.added()
     )
   }
@@ -1597,29 +1710,44 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       unkeyed = true
       return false
     }
+    // `'unchecked'` skips the check of the command's own window; a key the
+    // re-derive before the command already disagreed with still withholds,
+    // since it never described the bytes the command read.
+    if (stability.strategy === 'unchecked' && described!.hash === hash) return true
     const endCheck = span('miss: recheck inputs')
     const moved = await movedSinceKey()
     endCheck()
     if (moved === undefined) return true
     const what =
-      moved === null ? 'its inputs' : `\`${printable(relPosix(args.workspaceRoot, moved))}\``
+      (moved === null ? 'its inputs' : `\`${printable(relPosix(args.workspaceRoot, moved))}\``) +
+      ' changed after its key was taken' +
+      (rewroteBy === undefined ? '' : ` while ${rewroteBy} ran`)
     // A task that regenerates its own input (TanStack Router's committed
     // `routeTree.gen.ts`, rewritten to the same bytes by every build) is
     // never saved (item 1015), and the line said so without the way out.
-    // Not for `package.json`, which an output may not cover.
     const hint =
-      moved === null || path.basename(moved) === 'package.json'
+      moved === null || rewroteBy !== undefined
         ? ''
         : '; if the task writes it, declare it in cache.outputs'
-    log.status(
-      `[vx] ${node.id}: ${what} changed after its key was taken — the result stands, ` +
-        `but is not saved under a key that no longer describes it${hint}`,
-    )
+    if (stability.severity === 'error') {
+      log.status(
+        `[vx] ${node.id}: ${what} — the result is not saved, ` +
+          `and inputStability.severity is 'error', so the task fails${hint}`,
+      )
+      movedFails = moved === null ? '' : printable(relPosix(args.workspaceRoot, moved))
+    } else {
+      log.status(
+        `[vx] ${node.id}: ${what} — the result stands, ` +
+          `but is not saved under a key that no longer describes it${hint}`,
+      )
+    }
     forgetUndeclaredWrites(args, wsOutputs.length > 0 ? 'workspace' : 'project')
     unkeyed = true
     return false
   }
 
+  if (movedFails !== undefined) effectiveExitCode = 1
+
   if (unkeyedUpstream !== undefined && willWrite && effectiveExitCode === 0) {
     log.status(
       `[vx] ${node.id}: ran over ${unkeyedUpstream.node.id}'s outputs, which its key no longer ` +
@@ -1647,6 +1775,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       ? { failedOutput: failedOutputLog(output, willSave) }
       : {}),
     ...(result.timedOut === true && effectiveExitCode !== 0 ? { timedOut: true as const } : {}),
+    ...(movedFails !== undefined ? { inputMoved: movedFails } : {}),
     ...(result.cpuMs !== undefined ? { cpuMs: result.cpuMs } : {}),
     ...(result.peakRssBytes !== undefined ? { peakRssBytes: result.peakRssBytes } : {}),
     ...(result.where !== undefined ? { where: result.where } : {}),
@@ -1677,7 +1806,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
 /**
  * Drop the run's facts about files a task may have written without
  * declaring them (`undeclaredWriteReach`): the project's git snapshot and
- * its index OIDs, and its `package.json` digest. The next reader
+ * its index OIDs. The next reader
  * re-enumerates the project (one `git ls-files`) and hashes its files by
  * content; the per-declaration file-list memos are keyed on the snapshot
  * array, so they miss with it (item 743).
@@ -1686,12 +1815,10 @@ function forgetUndeclaredWrites(args: ExecuteArgs, reach: 'none' | 'project' | '
   if (reach === 'none') return
   if (reach === 'workspace') {
     args.gitFilesCache?.clear()
-    args.hashCache?.packageJson.clear()
     return
   }
   args.gitFilesCache?.delete(args.node.projectDir)
   args.gitFilesCache?.invalidateWorkspacePartition()
-  args.hashCache?.packageJson.delete(args.node.projectDir)
 }
 
 /** The two bin directories a task's PATH starts with: its own, then the root's (once when they coincide). */
@@ -1738,16 +1865,11 @@ function taskEnv(node: TaskNode, step: ExecConfig, workspaceRoot: string): NodeJ
   return env
 }
 
-function isAborted(signal: AbortSignal | undefined): boolean {
-  return signal?.aborted === true
+/** A task's own `exec.timeout` in ms; the schema has checked its form. */
+function taskTimeoutMs(step: ExecConfig): number | undefined {
+  return step.timeout === undefined ? undefined : parseDuration(step.timeout)!
 }
 
-/**
- * How long a server may take to match `readyWhen` before vx says it waits.
- * `VX_READY_NOTICE_MS` overrides it, as `VX_KILL_GRACE_MS` does the grace.
- */
-function readyNoticeMs(): number {
-  const raw = process.env['VX_READY_NOTICE_MS']
-  if (raw !== undefined && /^[0-9]+$/.test(raw) && Number(raw) > 0) return Number(raw)
-  return 10_000
+function isAborted(signal: AbortSignal | undefined): boolean {
+  return signal?.aborted === true
 }

package/src/orchestrator/fingerprint-watch.ts

@@ -1,18 +1,17 @@
-// The workspace fingerprint is read once per run, before any task, and
-// every key folds it (and a lockfile plugin's per-project parts, taken from
-// the same files). A task in the root project may rewrite one of those
-// files — `pnpm install` without `--frozen-lockfile` — and every key taken
+// The files the plugins claim (`VxPlugin.fingerprint`) are read once per
+// run, before any task, and every key folds what their claimant takes
+// from them (a lockfile plugin's per-project parts). A task in the root
+// project may rewrite one of those files — `pnpm install` without `--frozen-lockfile` — and every key taken
 // before it then names a lockfile the tree no longer holds: a save under
 // one filed bytes built against the new install under the old lockfile's
 // key, replayed whenever the tree went back (item 750). The watch answers
-// "has a fingerprinted file moved since the run read it", re-learning the
+// "has a claimed file moved since the run read it", re-learning the
 // fact only after a task that may have written one ran (`wrote`), so a run
 // with no such task never touches the files again.
 
 import { readFileSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { FILE_HASH_RACY_MS, racyWindowMs } from '../cache/index.js'
-import { WORKSPACE_FINGERPRINT_FILES, type WorkspaceFingerprints } from '../workspace/index.js'
 import type { Logger } from './logger.js'
 
 export class FingerprintWatch {
@@ -20,22 +19,26 @@ export class FingerprintWatch {
   private movedFiles: string[] | undefined
   private said = false
 
-  /** `at`: when the run started reading the files (ms since the epoch). */
+  /**
+   * `names`: the claimed files; `read`: the bytes of those that existed;
+   * `at`: when the run started reading them (ms since the epoch).
+   */
   constructor(
     private readonly workspaceRoot: string,
-    private readonly read: WorkspaceFingerprints,
+    readonly names: readonly string[],
+    private readonly read: ReadonlyMap<string, Uint8Array>,
     private readonly at: number,
   ) {}
 
-  /** A task that may rewrite a fingerprinted file (`mayWriteFingerprint`) ran a command. */
+  /** A task that may rewrite a claimed file (`mayWriteFingerprint`) ran a command. */
   wrote(): void {
     this.pending = true
   }
 
   /**
-   * The fingerprinted files that no longer hold what the run read, or
+   * The claimed files that no longer hold what the run read, or
    * undefined. Once one has, the run stays moved: every key already taken
-   * folded the old bytes. One `stat` per table entry after each writer; a
+   * folded the old bytes. One `stat` per claimed file after each writer; a
    * file written since the read (by ctime, with git's racy window) is read
    * and compared. The stat follows a link as both reads do: a lockfile
    * that is a symlink, rewritten through it, moves its target's ctime and
@@ -46,9 +49,9 @@ export class FingerprintWatch {
     if (this.movedFiles !== undefined || !this.pending) return this.movedFiles
     this.pending = false
     const moved: string[] = []
-    for (const f of WORKSPACE_FINGERPRINT_FILES) {
+    for (const f of this.names) {
       const abs = path.join(this.workspaceRoot, f)
-      const before = this.read.files.get(f)
+      const before = this.read.get(f)
       let ctimeMs: number
       try {
         ctimeMs = statSync(abs).ctimeMs
@@ -81,8 +84,8 @@ export class FingerprintWatch {
     if (this.said || this.movedFiles === undefined) return
     this.said = true
     log.status(
-      `[vx] a task rewrote \`${this.movedFiles.join('`, `')}\` during the run, which every key ` +
-        `folds (the workspace fingerprint): nothing keyed before it is restored or saved from here on`,
+      `[vx] a task rewrote \`${this.movedFiles.join('`, `')}\` during the run, which a plugin ` +
+        `folds into every key: nothing keyed before it is restored or saved from here on`,
     )
   }
 }