@vzn/vx 0.0.636 → 0.0.637

package/src/workspace/dependency-rules.ts

@@ -0,0 +1,57 @@
+import type { DependencyRule } from '../config.js'
+import { UserError } from '../util/index.js'
+import { compileNameGlob } from './filter.js'
+import type { PackageGraph } from './package-graph.js'
+
+/**
+ * `run.rules.dependencies`, held to each project's direct workspace
+ * dependencies (`PackageGraph.directDeps`: the manifest's and the
+ * cross-project `dependsOn` edges). A rule constrains the projects its
+ * `from` selects: each dependency must match an `allow` selector when
+ * `allow` is given, and no `deny` one. Every rule that selects a project
+ * applies, so a deny beats any allow. Checked by `vx lock` only (owner,
+ * 2026-10-13); every broken edge is named in one refusal.
+ */
+export function checkDependencyRules(
+  rules: readonly DependencyRule[],
+  projects: readonly string[],
+  tags: ReadonlyMap<string, readonly string[]>,
+  graph: PackageGraph,
+): void {
+  if (rules.length === 0) return
+  const compiled = rules.map((r) => ({
+    from: selector(r.from),
+    allow: r.allow?.map(selector),
+    deny: r.deny?.map(selector),
+  }))
+  const broken: string[] = []
+  for (const name of projects) {
+    const own = tags.get(name) ?? []
+    for (const [i, rule] of compiled.entries()) {
+      if (!rule.from(name, own)) continue
+      for (const dep of graph.directDeps(name)) {
+        const theirs = tags.get(dep) ?? []
+        const denied = rule.deny?.some((s) => s(dep, theirs)) === true
+        if (denied || (rule.allow !== undefined && !rule.allow.some((s) => s(dep, theirs))))
+          broken.push(
+            `${name} depends on ${dep}, which run.rules.dependencies[${i}] (from '${rules[i]!.from}') ${denied ? 'denies' : 'does not allow'}`,
+          )
+      }
+    }
+  }
+  if (broken.length === 0) return
+  throw new UserError(
+    `${broken.length === 1 ? '1 dependency breaks' : `${broken.length} dependencies break`} run.rules.dependencies:\n${broken.map((b) => `  ${b}`).join('\n')}\nDrop the dependency, or change the project's tags or the rule.`,
+    'VX_E_DEPENDENCY_RULE',
+  )
+}
+
+/** `tag:<glob>` matches a project carrying a matching tag; anything else, its name. */
+function selector(s: string): (name: string, tags: readonly string[]) => boolean {
+  if (s.startsWith('tag:')) {
+    const re = compileNameGlob(s.slice(4))
+    return (_, tags) => tags.some((t) => re.test(t))
+  }
+  const re = compileNameGlob(s)
+  return (name) => re.test(name)
+}

package/src/workspace/filter.ts

@@ -131,8 +131,8 @@ export function parseFilter(raw: string, workspaceRoot: string): ParsedFilter {
   if (s === '') throw new UserError(`filter "${raw}" names no project`)
 
   // `//` is Turbo's name for the root package (`--filter=//`, `//...`,
-  // `!//`, probed on 2.8.17). vx names the root project by its
-  // package.json name, so `//` is its directory, and only a project
+  // `!//`, probed on 2.8.17), and vx's for the root project unless
+  // something names it, so `//` is its directory, and only a project
   // there: read as `.`, it would select every project when the root is
   // none.
   if (s === '//') {

package/src/workspace/fingerprint.ts

@@ -1,129 +1,23 @@
 import path from 'node:path'
-import { xxh3 } from '../util/index.js'
 import { type LoadReads, readOnce } from './load-reads.js'
 
-// Every package-manager lockfile we know about, plus the workspace
-// definition files. Whichever ones exist get folded into the
-// fingerprint; missing ones are skipped. Hashed in declaration order
-// for determinism — adding a new entry here changes the fingerprint
-// for projects that have that file present, which is fine: that's the
-// whole point of bumping CACHE_VERSION when the fingerprint surface
-// expands.
-// Exported so `--affected` can consult the SAME list. A change to any of
-// these re-keys every task in the workspace, so selection has to widen to
-// match — two copies of this list would silently drift into a run that
-// rebuilds everything while selecting nothing.
-export const WORKSPACE_FINGERPRINT_FILES = [
-  // Lockfiles
-  'pnpm-lock.yaml',
-  'package-lock.json',
-  'npm-shrinkwrap.json',
-  'yarn.lock',
-  'bun.lock',
-  'bun.lockb',
-  // Workspace definition (pnpm); package.json is hashed per-project
-  // via projectPackageJsonHash, not here.
-  'pnpm-workspace.yaml',
-  // Yarn 4 catalogs: yarn.lock records a `catalog:` dependency as that
-  // literal, so a catalog flip to a range the file already resolves
-  // leaves it byte-identical while the workspace's install moves
-  // (turborepo#12635). pnpm's catalogs live in pnpm-workspace.yaml, and
-  // its lockfile records each importer's resolved version besides.
-  '.yarnrc.yml',
-  // Install settings no lockfile records: bun's `linker = "isolated"` and
-  // pnpm's `node-linker` / hoisting lay `node_modules` out anew under a
-  // byte-identical lockfile, and a build that imported an undeclared
-  // hoisted package kept its green hit where it now fails (D-7).
-  '.npmrc',
-  'bunfig.toml',
-]
-
-// DELIBERATELY ABSENT: `vx.workspace.{ts,mts,js,mjs,cts,cjs}`. Everything it can
-// declare — `concurrency`, `cacheDir`, `timeout`, and the
-// plugin list — is placement, storage or observability, never what a
-// command produces; core's three seams may change WHERE a task runs, not
-// WHAT it runs (architecture principle #3). Folding it in would also do
-// active harm: a laptop declaring only the local plugins and a CI runner
-// declaring `reapi()` would compute different fingerprints and share not
-// one cache entry — the same split the rejected `NODE_OPTIONS` non-goal
-// describes. A per-task input that genuinely varies belongs in
-// `cache.inputs`, which is the surface built for it.
-
-/**
- * One hash for the workspace as a whole, derived from whichever
- * lockfile + workspace-definition files exist at the root. Folded
- * into every task's cache key so any lockfile bump (`pnpm update`,
- * `npm install`, `bun install`, …) or a workspace-shape change
- * invalidates every cached entry. Coarse but correct.
- */
-export async function computeWorkspaceFingerprint(
-  workspaceRoot: string,
-  reads?: LoadReads,
-): Promise<string> {
-  return (await computeWorkspaceFingerprints(workspaceRoot, NONE, reads)).all
-}
-
-const NONE: ReadonlySet<string> = new Set()
-
-export interface WorkspaceFingerprints {
-  /** Every file folded — what the config-evaluation cache keys on. */
-  readonly all: string
-  /**
-   * The same fold minus the files a plugin claims (`VxPlugin.fingerprint`)
-   * — what every task key folds. Identical to `all` with nothing claimed.
-   */
-  readonly unclaimed: string
-  /**
-   * The bytes folded, by file name — what a mid-run check compares against
-   * when a task may have rewritten one (orchestrator/fingerprint-watch.ts).
-   * Already in memory for the fold; kept, not copied.
-   */
-  readonly files: ReadonlyMap<string, Uint8Array>
-}
-
 /**
- * Both digests from one read of each file — none at all for the
- * `pnpm-workspace.yaml` discovery already read into the load's `reads`. A
- * claimed file leaves the key digest entirely (its name too): the claimant
- * folds what it means per project, and a fold of "present" would still
- * re-key the workspace when the file appeared.
+ * The bytes of each named root file that exists: the files the plugins
+ * claim (`VxPlugin.fingerprint`), read once at run start so a task that
+ * rewrites one is caught (orchestrator/fingerprint-watch.ts). Core folds
+ * none of them into a key; the claimant does.
  */
-export async function computeWorkspaceFingerprints(
+export async function readClaimedFiles(
   workspaceRoot: string,
-  claimed: ReadonlySet<string>,
+  names: Iterable<string>,
   reads?: LoadReads,
-): Promise<WorkspaceFingerprints> {
-  let all = 0n
-  let unclaimed = 0n
+): Promise<ReadonlyMap<string, Uint8Array>> {
   const files = new Map<string, Uint8Array>()
-  for (const f of WORKSPACE_FINGERPRINT_FILES) {
+  for (const f of names) {
     const bytes = await readOnce(reads, path.join(workspaceRoot, f))
-    if (bytes === null) continue
-    files.set(f, bytes)
-    all = xxh3(`${f}\0`, all)
-    all = xxh3(bytes, all)
-    if (claimed.has(f)) continue
-    unclaimed = xxh3(`${f}\0`, unclaimed)
-    unclaimed = xxh3(bytes, unclaimed)
+    if (bytes !== null) files.set(f, bytes)
   }
-  // bun.lock names a patch by PATH, never by its content: an edited patch
-  // left the lockfile byte-identical and every key unmoved while the
-  // install applied the new one (item 1014, where only `bun()`'s claim
-  // learned it). Each file it names folds here; a claimed bun.lock's
-  // plugin folds them itself.
-  const bunLock = files.get('bun.lock')
-  if (bunLock !== undefined) {
-    for (const rel of bunPatchFiles(bunLock)) {
-      const bytes = await readOnce(reads, path.join(workspaceRoot, rel))
-      const mark = `patch\0${rel}\0${bytes === null ? 'gone' : 'present'}`
-      all = xxh3(mark, all)
-      if (bytes !== null) all = xxh3(bytes, all)
-      if (claimed.has('bun.lock')) continue
-      unclaimed = xxh3(mark, unclaimed)
-      if (bytes !== null) unclaimed = xxh3(bytes, unclaimed)
-    }
-  }
-  return { all: hex(all), unclaimed: hex(unclaimed), files }
+  return files
 }
 
 const PATCHED = new TextEncoder().encode('"patchedDependencies"')
@@ -132,7 +26,7 @@ const PATCHED = new TextEncoder().encode('"patchedDependencies"')
  * The workspace-relative patch files a `bun.lock` names, sorted; none
  * outside the workspace. A lockfile without the key is not parsed (the
  * common case costs one byte search), and one that will not parse names
- * none: its bytes still fold whole.
+ * none.
  */
 export function bunPatchFiles(bytes: Uint8Array): string[] {
   if (Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).indexOf(PATCHED) < 0) return []
@@ -153,7 +47,3 @@ export function bunPatchFiles(bytes: Uint8Array): string[] {
   }
   return [...out].sort()
 }
-
-function hex(h: bigint): string {
-  return h.toString(16).padStart(16, '0')
-}

package/src/workspace/index.ts

@@ -10,24 +10,23 @@ export {
   refIsHead,
 } from './affected.js'
 export { applyFilters, parseFilter } from './filter.js'
-export {
-  computeWorkspaceFingerprint,
-  computeWorkspaceFingerprints,
-  WORKSPACE_FINGERPRINT_FILES,
-  type WorkspaceFingerprints,
-} from './fingerprint.js'
+export { readClaimedFiles } from './fingerprint.js'
+export { checkDependencyRules } from './dependency-rules.js'
 export { computeNestedProjectDirs } from './nested-dirs.js'
 export { buildPackageGraph, type PackageGraph } from './package-graph.js'
 export {
   frozenProjectConfigs,
   LOCKFILE_NAME,
   LOCKFILE_VERSION,
+  LOCK_INVALID,
+  lockEntryBroken,
   lockfilePath,
-  FROZEN_WITHOUT_LOCK,
+  lockKey,
+  NO_LOCK,
   readLockfile,
   writeLockfile,
   type Lockfile,
-  type LockfileEntry,
+  type LockedProject,
 } from './lockfile.js'
 export {
   loadProjectConfig,
@@ -40,47 +39,41 @@ export {
   cacheScopeError,
   inputStabilityEnv,
   isCacheScope,
+  taskNameProblem,
   validateProjectConfig,
   validateWorkspace,
 } from './config-schema.js'
-export type { LoadProjectConfigOptions } from './project-loader.js'
-export {
-  blobOidOf,
-  configEvalKey,
-  configEvalKeyFromClosure,
-  configImports,
-  type ConfigEvalStore,
-} from './config-cache.js'
+export { configImports } from './config-imports.js'
 export {
+  checkProjectNames,
   findWorkspaceRoot,
-  discoverProjects,
-  listProjects,
-  namedProject,
-  loadWorkspace,
-  unreachedHint,
-  unreachedPackages,
-  memberBaseDirs,
+  findProjectConfigs,
+  discoveredProject,
+  linkDiscoveredEdges,
+  lockedProjects,
+  pathName,
   PROJECT_CONFIG_FILENAMES,
   resolveCacheDir,
   resolveStoreRoot,
+  ROOT_NAME,
+  type ConfigDir,
   type ProjectEntry,
   type ProjectMeta,
-  type Workspace,
 } from './workspace.js'
 export type { LoadReads } from './load-reads.js'
-// The migration seam (see migration.ts) and core's own mapper, the scripts one.
+// The migration seam (see migration.ts).
 export {
   applyMigration,
   foldScriptHooks,
-  PERSISTENT_TASK_NAMES,
   PERSISTENT_TODO,
   pruneOrphanPersistentNotes,
   quoteTsLiteral,
   type ApplyMigrationArgs,
   type MigrationFormat,
+  type MigrationMember,
   type GeneratedProject,
   type GeneratedTask,
   type MigrationPlan,
   type RawExpr,
+  vxInvocation,
 } from './migration.js'
-export { delegatedScript, migrateScripts } from './migrate-scripts.js'

package/src/workspace/load-reads.ts

@@ -1,6 +1,6 @@
 // A load reads each root file once. Finding the root reads its manifest,
-// listing the package globs read it again and the workspace fingerprint a
-// third time. Every such read goes through a `LoadReads` the load owns, so
+// listing the package globs read it again, and the claimed root files are
+// read for the run (`readClaimedFiles`). Every such read goes through a `LoadReads` the load owns, so
 // a file costs one probe and one read per load however many stages ask for
 // it. The map lives exactly as long as the load: a `vx watch` cycle is a
 // new load and reads fresh bytes.
@@ -14,8 +14,8 @@ export type LoadReads = Map<string, Promise<Uint8Array | null>>
  * `file`'s bytes, read at most once per `reads`; null when there is no file
  * there (`Bun.file(<dir>).exists()` is false, so a directory is none).
  *
- * The probe stays ahead of the read: most names asked about are absent (six
- * of the seven fingerprint files, three of the four workspace config names),
+ * The probe stays ahead of the read: most names asked about are absent
+ * (three of the four workspace config names, a manager's settings files),
  * and a failed read costs 90–200 µs building its error where `exists()`
  * answers in 15–40 µs (measured 2026-09-24) — so one stat per present file
  * is cheaper than letting the open answer both questions.

package/src/workspace/lockfile.ts

@@ -1,41 +1,43 @@
-// vx-lock.json — frozen resolved-config lockfile.
+// .vx/projects.lock.json — frozen resolved-config lockfile.
 //
-// `vx lock` evaluates every project's vx.config.* in the CURRENT
-// environment and freezes the resolved objects (plus a content hash of
-// each config file) into `vx-lock.json` at the workspace root. A run
-// under `--frozen` loads configs from it instead of evaluating —
-// frozen-env semantics; a plain run always evaluates live. See
-// docs/design/config-lock-2026-06.md.
+// `vx lock` finds every project's vx.config.*, evaluates each in the
+// CURRENT environment and freezes the resolved objects, by directory, into
+// `.vx/projects.lock.json` at the workspace root. Every run loads configs from
+// it and never evaluates one (owner, 2026-10-14); only `vx lock` writes
+// it. See docs/design/config-lock-2026-06.md.
 //
 // Verification asymmetry (deliberate):
-//   - `--frozen` runs TRUST the lock: no staleness check, eval-free.
-//   - `vx lock --check` AUDITS it: the file hashes, then full
-//     re-evaluation + deep equality, which catches eval-time env drift
-//     that file hashes cannot see.
+//   - runs TRUST the lock: no staleness check, no schema validation,
+//     eval-free.
+//   - `vx lock --check` AUDITS it: full re-evaluation + deep equality.
 
+import { readFileSync } from 'node:fs'
 import { rename, rm } from 'node:fs/promises'
 import path from 'node:path'
 import type { ProjectConfig } from '../config.js'
 import { relPosix, UserError, xxh3 } from '../util/index.js'
 import { VERSION } from '../version.js'
-import { CONFIG_EVAL_VERSION, type ConfigEvalStore } from './config-cache.js'
 import { validateProjectConfig } from './config-schema.js'
+import { PROJECT_CONFIG_FILENAMES } from './workspace.js'
 
-export const LOCKFILE_NAME = 'vx-lock.json'
-export const LOCKFILE_VERSION = 1
+export const LOCKFILE_NAME = '.vx/projects.lock.json'
+export const LOCKFILE_VERSION = 3
 
-export interface LockfileEntry {
-  /** Workspace-root-relative POSIX path to the project's config file. */
-  configPath: string
-  /** xxh3 hex of the config file bytes at lock time. */
-  configHash: string
-  /** The resolved (post-evaluation) config object, JSON-normalized. */
+/** One project as the lock holds it. */
+export interface LockedProject {
+  /** The config file's name in the directory (`vx.config.ts`). */
+  file: string
+  /** Its resolved (post-evaluation) config, JSON-normalized. */
   config: ProjectConfig
 }
 
 export interface Lockfile {
   version: number
-  projects: Record<string, LockfileEntry>
+  /**
+   * Root-relative POSIX directory (`.` for the root) → its project. Keyed
+   * by directory, so a name a plugin gives never invalidates the lock.
+   */
+  projects: Record<string, LockedProject>
   /** Written by `writeLockfile` from the bytes; never read off the object. */
   validated?: string
 }
@@ -44,12 +46,38 @@ export function lockfilePath(root: string): string {
   return path.join(root, LOCKFILE_NAME)
 }
 
-/** What a `--frozen` verb says when there is no lock to read. */
-export const FROZEN_WITHOUT_LOCK =
-  "--frozen requires vx-lock.json at the workspace root — run 'vx lock' and commit it"
+/** What a run says when a crash came from a hand-broken lock entry (M, 2026-10-14). */
+export const LOCK_INVALID = `${LOCKFILE_NAME} is invalid, run \`vx lock\``
 
 /**
- * Read and shape-validate `vx-lock.json`. Returns `null` when no lock
+ * Whether the lock holds an entry `vx lock` could not have written. Runs
+ * validate no entry, so a hand-broken one crashed deep in a run with a
+ * raw TypeError; asked only on that crash's path, so a run pays nothing.
+ */
+export function lockEntryBroken(root: string): boolean {
+  let projects: unknown
+  try {
+    projects = (JSON.parse(readFileSync(lockfilePath(root), 'utf8')) as { projects?: unknown })
+      .projects
+  } catch {
+    return false
+  }
+  if (typeof projects !== 'object' || projects === null) return false
+  for (const [dir, entry] of Object.entries(projects)) {
+    try {
+      validateProjectConfig((entry as LockedProject).config, `${LOCKFILE_NAME}: "${dir}"`, null)
+    } catch {
+      return true
+    }
+  }
+  return false
+}
+
+/** What a run says when there is no lock to read. */
+export const NO_LOCK = 'no lock: run `vx lock`'
+
+/**
+ * Read and shape-validate `.vx/projects.lock.json`. Returns `null` when no lock
  * exists (the common case — the feature is opt-in). The lock is a
  * user-editable file, so this is a system boundary: malformed content
  * throws a `UserError` instead of crashing deeper in the run.
@@ -84,68 +112,57 @@ export async function readLockfile(root: string): Promise<Lockfile | null> {
   }
   // Same trap, and this one is worse than a bad message: an ARRAY of entries is
   // ACCEPTED, because `Object.entries` happily walks it — yielding a project
-  // literally named "0". `--frozen` then looks up real project names against a
-  // lock that declares none of them.
+  // at directory "0".
   if (typeof lock.projects !== 'object' || lock.projects === null || Array.isArray(lock.projects)) {
     throw new UserError(`${LOCKFILE_NAME}: \`projects\` must be an object — re-run \`vx lock\``)
   }
-  for (const [name, entry] of Object.entries(lock.projects)) {
-    const e = entry as Partial<LockfileEntry> | null
+  for (const [dir, entry] of Object.entries(lock.projects)) {
+    const { file, config } = (entry ?? {}) as { file?: unknown; config?: unknown }
     if (
-      !e ||
-      typeof e.configPath !== 'string' ||
-      typeof e.configHash !== 'string' ||
-      typeof e.config !== 'object' ||
-      e.config === null
+      typeof entry !== 'object' ||
+      entry === null ||
+      Array.isArray(entry) ||
+      typeof file !== 'string' ||
+      !PROJECT_CONFIG_FILENAMES.includes(file) ||
+      typeof config !== 'object' ||
+      config === null ||
+      Array.isArray(config)
     ) {
-      throw new UserError(`${LOCKFILE_NAME}: entry for "${name}" is malformed — re-run \`vx lock\``)
+      throw new UserError(`${LOCKFILE_NAME}: entry for "${dir}" is malformed — re-run \`vx lock\``)
     }
   }
-  lockDigests.set(parsed, xxh3(text).toString(16))
-  const stamped = VALIDATED_LINE.exec(text)
-  if (stamped !== null && stamped[1] === validatedDigest(text.slice(0, stamped.index) + '\n}')) {
-    selfValidated.add(parsed)
-  }
   return parsed as Lockfile
 }
 
-/** The digest of the bytes each lock `readLockfile` returned was parsed from. */
-const lockDigests = new WeakMap<object, string>()
-
 /**
- * The lock's own record that this vx validated its entries: `vx lock`
- * evaluates and validates every config, then writes a digest of the bytes
- * it wrote, under vx's version (validation's rules are vx's alone, so Bun's
- * is left out and does not churn a committed lock), as the last field. A lock
- * whose digest matches is validated already, and a cold `--frozen` run
- * skips the ~30 ms of validating 1,090 entries before its first task. An
- * edit, a merge, or another vx version leaves it unmatched, and the
- * entries are validated as before.
+ * `vx lock` evaluates and validates every config, then writes a digest of
+ * the bytes it wrote, under vx's version, as the last field: the lock's
+ * record of which vx validated it. No reader consults it.
  */
-const VALIDATED_LINE = /,\n {2}"validated": "([0-9a-f]+)"\n\}\n?$/
-const selfValidated = new WeakSet<object>()
-
 function validatedDigest(body: string): string {
-  return xxh3(`vx-lock-valid-v${CONFIG_EVAL_VERSION}\0${VERSION}\0${body}`).toString(16)
+  return xxh3(`vx-lock-valid-v3\0${VERSION}\0${body}`).toString(16)
 }
 
 export async function writeLockfile(root: string, lock: Lockfile): Promise<void> {
   // Written beside its name and renamed over it: `Bun.write` truncates in
-  // place, so a `--frozen` run, or `vx watch --frozen` woken by the write
+  // place, so a run, or `vx watch` woken by the write
   // itself (item 971), could read an empty or half-written lock and fail
   // on "not valid JSON" (item 972).
   const file = lockfilePath(root)
   const tmp = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`
   try {
-    const body = JSON.stringify({ version: lock.version, projects: lock.projects }, null, 2)
-    await Bun.write(tmp, `${body.slice(0, -2)},\n  "validated": "${validatedDigest(body)}"\n}\n`)
+    // Minified: the file only vx reads, and it loads faster than pretty
+    // JSON (measured, 10k projects: 15.6 ms against 22.5 ms). `vx.lock.json`
+    // beside each config is the copy for people.
+    const body = JSON.stringify({ version: lock.version, projects: lock.projects })
+    await Bun.write(tmp, `${body.slice(0, -1)},"validated":"${validatedDigest(body)}"}\n`)
     await rename(tmp, file)
   } catch (err) {
     // Best effort: where the write was refused the temp cannot be named
     // either (ENOTDIR), and that must not replace the refusal itself.
     await rm(tmp, { force: true }).catch(() => {})
     // The refusal names the file the user knows: a read-only checkout read
-    // `open '…/vx-lock.json.tmp-…'` where it had read the lock's own name.
+    // `open '…/.vx/projects.lock.json.tmp-…'` where it had read the lock's own name.
     const e = err as NodeJS.ErrnoException
     if (typeof e.message === 'string') e.message = e.message.split(tmp).join(file)
     if (e.path === tmp) e.path = file
@@ -155,93 +172,32 @@ export async function writeLockfile(root: string, lock: Lockfile): Promise<void>
 
 /**
  * Run-time config load from the lock: return the FROZEN resolved config
- * for each project, in order. No evaluation happens — this is the fast,
- * eval-free trust path — and no staleness check either (see below): the
- * lock's contract is "what runs is what was locked", so a config file
- * edited since `vx lock` still runs as locked until `vx lock --check`
- * says otherwise. An unlocked project is a hard error; silently falling
- * back to evaluation would break frozen-env semantics.
- *
- * `store` remembers which entries of which lock bytes this validator
- * accepted, beside the config evaluations and keyed like them (vx's and
- * Bun's versions): validating 1,000 entries was ~30 ms of every warm
- * `--frozen` run, for a verdict that cannot change until the bytes or vx
- * do.
+ * for each project, in order. No evaluation happens, and no staleness
+ * check or schema validation either: the lock's contract is "what runs is
+ * what was locked", `vx lock` validated every entry it wrote, and
+ * `vx lock --check` re-evaluates them all. An unlocked project is a hard
+ * error; a run never evaluates.
  */
-export async function frozenProjectConfigs(
+export function frozenProjectConfigs(
   lock: Lockfile,
-  metas: ReadonlyArray<{ name: string; configPath: string }>,
+  metas: ReadonlyArray<{ name: string; dir: string; configPath: string }>,
   root: string,
-  store?: ConfigEvalStore,
-): Promise<ProjectConfig[]> {
-  const entries = metas.map((meta) => {
-    const rel = relPosix(root, meta.configPath)
+): ProjectConfig[] {
+  return metas.map((meta) => {
+    const dir = lockKey(root, meta.dir)
     // Own entries only: `constructor` read Object's, "locked" at undefined (D-152).
-    const entry = Object.hasOwn(lock.projects, meta.name) ? lock.projects[meta.name] : undefined
-    if (entry !== undefined && entry.configPath !== rel) {
-      // A renamed or moved config: "has no entry for a" named an entry the
-      // lock holds, under its old path (D-88).
-      throw new UserError(
-        `${LOCKFILE_NAME} locks "${meta.name}" at ${entry.configPath}, but its config is ${rel} now — ` +
-          `run \`vx lock\` to refresh, or delete ${LOCKFILE_NAME}`,
-      )
-    }
-    if (!entry) {
+    const entry = Object.hasOwn(lock.projects, dir) ? lock.projects[dir] : undefined
+    if (entry === undefined) {
       throw new UserError(
-        `${LOCKFILE_NAME} has no entry for "${meta.name}" (${rel}) — ` +
-          `run \`vx lock\` to refresh, or delete ${LOCKFILE_NAME}`,
+        `${LOCKFILE_NAME} has no entry for "${meta.name}" (${relPosix(root, meta.configPath)}) — ` +
+          'run `vx lock`',
       )
     }
-    return entry
+    return entry.config
   })
-  // No staleness checks here, deliberately: --frozen runs after
-  // `vx lock --check` in any sane pipeline, and that audit re-
-  // evaluates everything — a per-file byte-hash re-check would be
-  // redundant work and a weaker guarantee pretending to add safety
-  // (it can't see import closures or env anyway). configHash stays
-  // in the file solely for --check's fast file-changed reporting.
-  // The lock is hand-editable; the stored config crosses the same
-  // boundary a freshly evaluated one does.
-  const digest = store === undefined ? undefined : lockDigests.get(lock)
-  const prefix =
-    digest === undefined
-      ? undefined
-      : `vx-lock-valid-v${CONFIG_EVAL_VERSION}\0${VERSION}\0${Bun.version}\0${digest}`
-  // One row for a lock whose every entry was accepted: a warm `--all` run
-  // asked for 1,090 per-project rows in one `IN` query, ~10 ms of its
-  // config load, where the eval-cache path it replaces is cheaper (X-181).
-  // A scoped run still validates, and remembers, only what it loads.
-  if (
-    selfValidated.has(lock) ||
-    (prefix !== undefined && store !== undefined && store.getConfigEval(prefix) !== null)
-  ) {
-    return entries.map((e) => e.config)
-  }
-  const keys = prefix === undefined ? undefined : metas.map((m) => `${prefix}\0${m.name}`)
-  const known =
-    keys === undefined || store === undefined
-      ? new Map<string, string>()
-      : store.getConfigEvals !== undefined
-        ? store.getConfigEvals(keys)
-        : new Map(keys.flatMap((k) => (store.getConfigEval(k) === null ? [] : [[k, '1'] as const])))
-  const accepted: Array<readonly [string, string]> = []
-  for (let i = 0; i < entries.length; i++) {
-    const key = keys?.[i]
-    if (key !== undefined && known.has(key)) continue
-    validateProjectConfig(entries[i]!.config, `${LOCKFILE_NAME} (${metas[i]!.name})`)
-    if (key !== undefined) accepted.push([key, '1'])
-  }
-  // Every meta found its entry above, so as many distinct names as the
-  // lock holds is every entry of it.
-  if (
-    prefix !== undefined &&
-    new Set(metas.map((m) => m.name)).size === Object.keys(lock.projects).length
-  ) {
-    accepted.push([prefix, '1'])
-  }
-  if (store !== undefined && accepted.length > 0) {
-    if (store.putConfigEvals !== undefined) store.putConfigEvals(accepted)
-    else for (const [k, v] of accepted) store.putConfigEval(k, v)
-  }
-  return entries.map((e) => e.config)
+}
+
+/** A project directory as the lock keys it: root-relative POSIX, `.` for the root. */
+export function lockKey(root: string, dir: string): string {
+  return relPosix(root, dir) || '.'
 }