@vzn/vx 0.0.638 → 0.0.639

package/src/cli/upgrade.ts

@@ -10,6 +10,8 @@
 // package manager (npm, pnpm, bun, yarn; global or a project's
 // dependency) is upgraded by that package manager, never by a rename over
 // a file it owns. vx never installs Node or a package manager.
+// Handed a call by a global vx, the project's vx moves that global too,
+// to the same version (`upgradeGlobal`).
 // Named `upgrade` (not `update`) per CLI convention: bun upgrade,
 // deno upgrade — "update" is what package managers do to indexes.
 
@@ -290,17 +292,19 @@ export function binaryFromTarball(tgz: Uint8Array): Uint8Array {
 /**
  * The binary of `pkg@spec`, verified: the registry document's signature,
  * then the tarball's integrity, then the extraction, each refusing before
- * the next step runs. Null when the release is this vx's own version;
- * `announce` hears the version before the download starts.
+ * the next step runs. Null when the release is `current`, the version of
+ * the vx being replaced; `announce` hears the version before the download
+ * starts.
  */
 export async function releaseBinary(
   pkg: string,
   spec: string,
   announce: (version: string) => void,
   key: SigningKey = NPM_SIGNING_KEY,
+  current = VERSION,
 ): Promise<Uint8Array | null> {
   const release = verifiedRelease(await fetchManifest(pkg, spec), pkg, key)
-  if (release.version === VERSION) return null
+  if (release.version === current) return null
   announce(release.version)
   return binaryFromTarball(await downloadVerified(release))
 }
@@ -518,15 +522,24 @@ async function targetVersion(tag: string | undefined): Promise<string> {
   return v
 }
 
-/** Run the package manager that owns this vx; vx never installs one. */
-async function upgradeManaged(install: ManagedInstall, tag: string | undefined): Promise<number> {
-  const version = await targetVersion(tag)
-  if (version === VERSION) {
-    ui.print('out', ui.status('info', 'vx upgrade', `already at ${VERSION}`))
-    return 0
+/**
+ * Run the package manager that owns a vx at `current` to bring it to
+ * `version`; vx never installs one. `step` names the install when a run
+ * moves two (`project `, `global `).
+ */
+async function upgradeManaged(
+  install: ManagedInstall,
+  version: string,
+  current = VERSION,
+  step = '',
+): Promise<void> {
+  if (version === current) {
+    ui.print('out', ui.status('info', 'vx upgrade', `${step}already at ${current}`))
+    return
   }
   const argv = upgradeArgv(install, version)
-  const bin = Bun.which(argv[0]!)
+  // PATH as it is now: `Bun.which` alone reads the one the process started with.
+  const bin = Bun.which(argv[0]!, { PATH: process.env['PATH'] ?? '' })
   if (bin === null) {
     throw new UserError(
       `vx upgrade: this vx was installed by ${argv[0]}, which is not on PATH — vx does not install package managers; run it yourself: ${argv.join(' ')} (in ${install.cwd})`,
@@ -534,7 +547,7 @@ async function upgradeManaged(install: ManagedInstall, tag: string | undefined):
   }
   ui.print(
     'out',
-    ui.status('info', 'vx upgrade', `${VERSION} → ${version}`),
+    ui.status('info', 'vx upgrade', `${step}${current} → ${version}`),
     ui.text([ui.cmd(argv.join(' ')), ui.dim(` in ${install.cwd}`)]),
   )
   const proc = Bun.spawnSync({
@@ -547,7 +560,90 @@ async function upgradeManaged(install: ManagedInstall, tag: string | undefined):
       `vx upgrade: ${argv.join(' ')} failed (exit ${proc.exitCode}) — vx changed nothing itself`,
     )
   }
-  return 0
+}
+
+/**
+ * Replace the binary at `dest`, at `current`, with the verified release
+ * `spec` names (`latest` or a version). `step` as in `upgradeManaged`.
+ */
+async function upgradeBinary(
+  dest: string,
+  spec: string,
+  current = VERSION,
+  step = '',
+  key: SigningKey = NPM_SIGNING_KEY,
+): Promise<void> {
+  const pkg = platformPackage()
+  let installed: string | undefined
+  const replaced = await replaceBinary(
+    dest,
+    () =>
+      releaseBinary(
+        pkg,
+        spec,
+        (version) =>
+          ui.print(
+            'out',
+            ui.status('info', 'vx upgrade', `${step}${current} → ${version}`),
+            ui.text(ui.dim(dest)),
+          ),
+        key,
+        current,
+      ),
+    // The replaced binary's own version: the new build speaks for itself
+    // rather than this process guessing, and one that cannot is rolled back.
+    (bin) => {
+      installed = answeredVersion(bin)
+      return installed !== undefined
+    },
+  )
+  ui.print(
+    'out',
+    replaced
+      ? ui.status('ok', 'vx upgrade', `${step}installed ${installed}`)
+      : ui.status('info', 'vx upgrade', `${step}already at ${current}`),
+  )
+}
+
+/** The version `bin --version` answers, without the hand-off note a handed-off run adds. */
+function answeredVersion(bin: string): string | undefined {
+  return startedVersion(bin)?.split(' ')[1]
+}
+
+/**
+ * Bring `from`, the global vx that handed this run to the project's own
+ * (`VX_HANDED_OFF`), to `version`, the way it was installed: a binary
+ * installed by hand is replaced, a package manager's global install is
+ * updated by that manager. A refusal names it.
+ */
+export async function upgradeGlobal(
+  from: string,
+  version: string,
+  key: SigningKey = NPM_SIGNING_KEY,
+): Promise<void> {
+  await named(`global vx ${from}`, async () => {
+    const current = answeredVersion(from)
+    if (current === undefined) {
+      throw new UserError('vx upgrade: it did not answer `--version`, so it is left as it is')
+    }
+    if (current === version) {
+      ui.print('out', ui.status('info', 'vx upgrade', `global already at ${current}`))
+      return
+    }
+    const install = managedInstall(from, path.dirname(from))
+    if (install === null) await upgradeBinary(from, version, current, 'global ', key)
+    else await upgradeManaged(install, version, current, 'global ')
+  })
+}
+
+/** `run`, its refusal naming `what` after the verb: a run that moves two installs says which failed. */
+async function named(what: string, run: () => Promise<void>): Promise<void> {
+  try {
+    await run()
+  } catch (err) {
+    if (!(err instanceof UserError)) throw err
+    throw new UserError(err.message.replace(/^vx upgrade: /, `vx upgrade: ${what}: `), err.code)
+  }
 }
 
 export async function upgradeCmd(args: readonly string[]): Promise<number> {
@@ -575,33 +671,21 @@ export async function upgradeCmd(args: readonly string[]): Promise<number> {
   }
   const dest = process.execPath
   const install = managedInstall(dest, process.cwd())
-  if (install !== null) return await upgradeManaged(install, tag)
-  const pkg = platformPackage()
-  const spec = versionSpec(tag)
-  let installed = ''
-  const replaced = await replaceBinary(
-    dest,
-    () =>
-      releaseBinary(pkg, spec, (version) =>
-        ui.print(
-          'out',
-          ui.status('info', 'vx upgrade', `${VERSION} → ${version}`),
-          ui.text(ui.dim(dest)),
-        ),
-      ),
-    // The replaced binary's own version: the new build speaks for itself
-    // rather than this process guessing, and one that cannot is rolled back.
-    (bin) => {
-      installed = startedVersion(bin) ?? ''
-      return installed !== ''
-    },
-  )
-  ui.print(
-    'out',
-    replaced
-      ? ui.status('ok', 'vx upgrade', `installed ${installed.replace(/^vx /, '')}`)
-      : ui.status('info', 'vx upgrade', `already at ${VERSION}`),
-  )
+  // A global vx handed this run to the project's own: both move, to one
+  // version, the project first (owner, 2026-10-15).
+  const from = process.env['VX_HANDED_OFF']
+  if (from !== undefined) {
+    const version = await targetVersion(tag)
+    await named('project vx', () =>
+      install === null
+        ? upgradeBinary(dest, version, VERSION, 'project ')
+        : upgradeManaged(install, version, VERSION, 'project '),
+    )
+    await upgradeGlobal(from, version)
+    return 0
+  }
+  if (install !== null) await upgradeManaged(install, await targetVersion(tag))
+  else await upgradeBinary(dest, versionSpec(tag))
   return 0
 }
 

package/src/cli/watch-cycle.ts

@@ -5,7 +5,8 @@
 // as Ctrl-C would and the loop starts the next one; a cycle running any
 // other work is never stopped.
 
-import { createEventBus, type RunOptions } from '../orchestrator/index.js'
+import { type RunOptions } from '../orchestrator/index.js'
+import { createEventBus } from '../report/index.js'
 
 export interface WatchCycle {
   /** The options for this cycle's run: its own bus and a stop of its own beside watch's. */

package/src/cli/watch.ts

@@ -61,22 +61,17 @@ const DEBOUNCE_MAX_MS = 1_000
  * the help line and the completions, and a test holds the two together.
  */
 export function watchRefusal(parsed: RunArgs): string | null {
-  if (parsed.dry !== undefined || parsed.graph !== undefined) {
-    return 'vx watch: --dry / --graph are not supported in watch mode'
+  if (parsed.dry !== undefined) {
+    return 'vx watch: --dry is not supported in watch mode'
   }
-  if (parsed.summarize !== undefined || parsed.profile !== undefined) {
-    return 'vx watch: --summarize / --profile are not supported in watch mode (would overwrite per cycle)'
+  if (parsed.profile !== undefined) {
+    return 'vx watch: --profile is not supported in watch mode (would overwrite per cycle)'
   }
-  // All three format ONE run's result and are consumed by `runCmd` alone, so
-  // a watch loop silently ignored them. `--verbosity 0` is not rejected: it
+  // It formats ONE run's result and is consumed by `runCmd` alone, so a
+  // watch loop silently ignored it. `--verbosity 0` is not rejected: it
   // asks for the output watch already gives.
-  if (
-    parsed.report !== undefined ||
-    parsed.reportFile !== undefined ||
-    parsed.verbosity > 0 ||
-    parsed.format !== 'pretty'
-  ) {
-    return 'vx watch: --report / --report-file / --verbosity / --format are not supported in watch mode (they report a single run)'
+  if (parsed.verbosity > 0) {
+    return 'vx watch: --verbosity is not supported in watch mode (it reports a single run)'
   }
   return null
 }
@@ -626,6 +621,19 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<void> {
     }
   }
   const stale = (dir: string): boolean => armedAs.get(dir) !== inodeOf(dir)
+  /** The projects the workspace-wide arm names an event by. */
+  let wide: readonly ProjectMeta[] = []
+  // The deepest, as a nested project's file is its own.
+  const ownerOf = (abs: string): ProjectMeta | undefined => {
+    let best: ProjectMeta | undefined
+    for (const proj of wide)
+      if (
+        abs.startsWith(proj.dir + path.sep) &&
+        (best === undefined || proj.dir.length > best.dir.length)
+      )
+        best = proj
+    return best
+  }
   /** The root arm: recursive when workspace-wide or the one stream, else the root's own files only. */
   let rootArm: WatchHandle = CLOSED
   let dotVxArm: WatchHandle = CLOSED
@@ -700,7 +708,13 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<void> {
               configImportFiles.includes(abs)
             )
               reread = true
-            trigger(`root ${filename}`, abs)
+            const owner = ownerOf(abs)
+            trigger(
+              owner === undefined
+                ? `root ${filename}`
+                : `${owner.name} ${path.relative(owner.dir, abs)}`,
+              abs,
+            )
           })
         : oneStream
           ? arm(workspaceRoot, true, streamEvent)
@@ -725,6 +739,7 @@ async function runWatchLoop(args: WatchLoopArgs): Promise<void> {
   // (it would cover every project + node_modules + caches). On macOS one
   // recursive stream at the root stands for all of them (`oneStream`).
   const armMode = (watched: readonly ProjectMeta[]): void => {
+    wide = workspaceWide ? watched : []
     if (!workspaceWide) {
       streamed = oneStream ? toStream(watched) : []
       const inStream = new Set(streamed.map((s) => s.proj))

package/src/cli/why.ts

@@ -9,13 +9,13 @@ import { flagHint, formatValue, seeHelp } from './help.js'
 import { splitTaskId } from '../graph/index.js'
 import {
   cacheKeyDiff,
-  explainCacheKeyQuery as explainCacheKey,
+  explainCacheKey,
   inputWriters,
   latestRunId,
   rootCauses,
-  whyDidThisRerunQuery as whyDidThisRerun,
-  resolveRunId,
-} from '../orchestrator/index.js'
+  whyDidThisRerun,
+} from '../history/index.js'
+import { resolveRunId } from '../orchestrator/index.js'
 import { MASKED, nearMatches, printable, refusal, UserError } from '../util/index.js'
 import { findWorkspaceRoot } from '../workspace/index.js'
 import { findCwdProject } from './select.js'

package/src/config.ts

@@ -62,12 +62,6 @@ export interface RunSettings {
    * default) skips its dependents, `always` runs them too.
    */
   continue?: 'never' | 'deps-ok' | 'always'
-  /** How long a task that ignores SIGTERM gets before SIGKILL. Omitted → `'2s'`. */
-  killGrace?: Duration
-  /** The bound on each plugin's end-of-run flush and teardown. Omitted → `'3s'`. */
-  teardownTimeout?: Duration
-  /** How long a persistent task may take to match `readyWhen` before vx says it waits. Omitted → `'10s'`. */
-  readyNotice?: Duration
   /**
    * Graph rules checked by `vx lock` and `vx lock --check`, never by a
    * run. Each is on

package/src/exec/executor.ts

@@ -142,7 +142,7 @@ export interface ExecuteRequest {
    * work and returns: a child an executor spawned is not one core can
    * reach (H-10, H-12). One already aborted is work not to start (B-55).
    * Any exit after the timeout's abort, a 0 included, is a timeout. Core
-   * waits the kill grace (`VX_RUN_KILL_GRACE`, 2 s) after the abort, then
+   * waits the kill grace (2 s) after the abort, then
    * settles the attempt without `execute` and abandons it (H-14).
    */
   readonly signal?: AbortSignal

package/src/exec/sandbox-runtime.ts

@@ -2332,7 +2332,7 @@ function outsideWritesHint(
     ? `${refused} The task has its own temp directory, empty at its start: write under ` +
       `$TMPDIR (os.tmpdir() in Node and Bun) instead of a fixed path.`
     : `${refused} If the task needs one, grant its directory, e.g. ` +
-      `\`allow: { write: [${jsString(`${spelled}/`)}] }\`.`
+      `\`allow: { write: [${jsString(spelled.endsWith('/') ? spelled : `${spelled}/`)}] }\`.`
   return { timestamp: new Date(), hint: true, line }
 }
 

package/src/exec/sandbox-violations.ts

@@ -578,7 +578,9 @@ export function refusedWritesOutside(
     if (v.path === undefined || !path.isAbsolute(v.path) || !write || reported(v)) continue
     if (!skip.some((s) => atOrUnder(v.path!, s))) paths.add(v.path)
   }
-  return [...paths]
+  // `mkdir -p ~/.cache/tool` is refused at each directory on its way;
+  // the one it wanted is the deepest.
+  return [...paths].filter((p) => ![...paths].some((q) => q !== p && atOrUnder(q, p)))
 }
 
 /**

package/src/graph/index.ts

@@ -8,6 +8,7 @@ export {
   parseDependencySpec,
   type DependencySpec,
 } from './dependency-spec.js'
+export { computeReverseDepCount } from './priorities.js'
 export {
   type ContinueMode,
   deadServerBehind,
@@ -16,8 +17,15 @@ export {
   RestoreDemoted,
   runGraph,
   type TaskOutcome,
-  type TaskStatus,
 } from './scheduler.js'
+export {
+  type CacheSource,
+  deriveCacheSource,
+  isCacheHit,
+  isPassStatus,
+  TASK_STATUSES,
+  type TaskStatus,
+} from './task-status.js'
 export {
   buildTaskGraph,
   checkGraph,

package/src/graph/priorities.ts

@@ -85,7 +85,7 @@ export function tieredReverseDepCount(
  * dependents only (`calculateReverseDeps` in
  * `packages/nx/src/tasks-runner/utils.ts`, read 2026-09-24).
  */
-export function computeReverseDepCount(nodes: Map<string, TaskNode>): Map<string, number> {
+export function computeReverseDepCount(nodes: ReadonlyMap<string, TaskNode>): Map<string, number> {
   // Exact transitive-dependent COUNTS need closure SETS (diamonds
   // double-count under naive summing). Set-of-strings closures are
   // O(N²) entries and took 8.5s on a 1090-package, 100-layer repo;

package/src/graph/scheduler.ts

@@ -13,6 +13,7 @@ import {
   type ScheduleStrategy,
 } from './priorities.js'
 import { isGroupTask, type TaskNode } from './task-graph.js'
+import type { TaskStatus } from './task-status.js'
 
 /**
  * Thrown by `execute` for a restore-tier task that turned out to have
@@ -29,19 +30,6 @@ export class RestoreDemoted extends Error {
   }
 }
 
-export type TaskStatus =
-  | 'success'
-  | 'cache-hit'
-  | 'cache-hit-remote'
-  | 'failed'
-  | 'skipped'
-  // A child killed by a shutdown signal (SIGINT/SIGTERM — e.g. Ctrl-C):
-  // the task never finished on its own terms, so it reverts to aborted —
-  // excluded from the tally and the run history. It still PROPAGATES like
-  // a failure (see `willSkip`): the child died mid-write, so its outputs
-  // are partial.
-  | 'aborted'
-
 /** What moved in a missed task's key since the last entry saved for it. */
 export interface InputChanges {
   /** How many components changed, appeared or went. 0: the same key, its entry gone. */
@@ -79,8 +67,8 @@ export interface TaskOutcome {
    * How long an `admit` policy held this task after it was ready with a
    * free worker — the wait the plugin, not the count gate, imposed. Set
    * only when a policy refused it at least once (so a run with no policy
-   * carries the field on no outcome); `--summarize` rows, the event
-   * stream and the summary footer show it.
+   * carries the field on no outcome); the event stream and the summary
+   * footer show it.
    */
   admissionHeldMs?: number
   /**
@@ -136,7 +124,7 @@ export interface TaskOutcome {
    * On a `skipped` outcome: the task at the ROOT of what blocked it — the
    * failed (or aborted) upstream, followed through any chain of skips
    * between. Absent when the skip was fail-fast's (no upstream failed).
-   * The footer, `--summarize`, the telemetry record and the run row all
+   * The footer, the telemetry record and the run row all
    * read this one field (item 267).
    */
   blockedBy?: string

package/src/graph/task-graph.ts

@@ -1,7 +1,10 @@
 import type { ProjectConfig, TaskConfig, WorkspaceRules } from '../config.js'
 import {
   asTrees,
+  checkIgnoreSync,
+  ignoreProbes,
   isLiteralPattern,
+  listedSync,
   normalizeGlob,
   relPosix,
   splitNegations,
@@ -9,6 +12,7 @@ import {
   taskGlob,
   refusal,
   UserError,
+  wholeIgnored,
   wholeSubtreePrefixes,
 } from '../util/index.js'
 import type { PackageGraph, ProjectEntry } from '../workspace/index.js'
@@ -584,7 +588,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
       // task behind it would fold no upstream either.
       if (!packageGraph.edgeSource) {
         throw new UserError(
-          `${id}: ^${spec.task} needs project edges; add pnpm()/bun()/npm()/yarn() or a plugin that returns \`deps\``,
+          `${id}: ^${spec.task} needs project edges; add pnpm()/bun()/npm()/yarn() and install so its lockfile exists, or a plugin that returns \`deps\``,
           'VX_E_DEPENDS_ON',
         )
       }
@@ -1128,6 +1132,15 @@ function detectOutputCollisions(
   }
 }
 
+/**
+ * What a task's `!` output entries take back (A-44). A glob of the other
+ * task's that one takes back whole is a path this task never cleans or
+ * captures, so the pair cannot collide there.
+ */
+function takenBackOf(n: TaskNode, field: 'files' | 'workspaceFiles'): string[] {
+  return splitNegations(n.config.cache?.outputs[field] ?? []).negative
+}
+
 /**
  * `collide` for a root-anchored output against another project's `files`
  * output rebased to the root. With an edge the dependant adds to its
@@ -1146,9 +1159,12 @@ function collideAcross(
   exclusive: boolean,
 ): void {
   if (neverWritesLocally(ws) || neverWritesLocally(files)) return
+  const wsBack = takenBackOf(ws, 'workspaceFiles')
+  const filesBack = takenBackOf(files, 'files').map((g) => (rel === '' ? g : `${rel}/${g}`))
   for (const ga of wsGlobs) {
     for (const gb of rebased) {
-      if (!outputsOverlap(ga, gb)) continue
+      if (!outputsOverlap(ga, gb) || outputTakenBack(gb, wsBack) || outputTakenBack(ga, filesBack))
+        continue
       const head =
         `${ws.id} declares the output ${JSON.stringify(ga)} in cache.outputs.workspaceFiles, ` +
         `inside ${files.id}'s ${JSON.stringify(gb.slice(rel === '' ? 0 : rel.length + 1))} in ` +
@@ -1405,9 +1421,12 @@ function collide(
   exclusive: boolean,
 ): void {
   if (neverWritesLocally(a) || neverWritesLocally(b)) return
+  const aBack = takenBackOf(a, field)
+  const bBack = takenBackOf(b, field)
   for (const ga of aGlobs ?? []) {
     for (const gb of bGlobs ?? []) {
-      if (!outputsOverlap(ga, gb)) continue
+      if (!outputsOverlap(ga, gb) || outputTakenBack(gb, aBack) || outputTakenBack(ga, bBack))
+        continue
       const head =
         `${a.id} and ${b.id} both declare the output ${JSON.stringify(ga)}` +
         (ga === gb ? '' : ` / ${JSON.stringify(gb)}`) +
@@ -1550,6 +1569,8 @@ interface Side {
   reads: boolean
   /** The project's root-relative dir for rebased `files` globs. */
   rel?: string
+  /** The root-relative dir project-relative `globs` sit in, for git. */
+  anchor?: string | undefined
 }
 
 /**
@@ -1583,6 +1604,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   let projectReaders = false
   let rootReaders = false
   const memo: TakeBackMemo = { bySide: new Map(), byList: new Map() }
+  const found: Found = new Map()
   const bucket = (name: string): Side[] => {
     let list = byProject.get(name)
     if (list === undefined) byProject.set(name, (list = []))
@@ -1594,7 +1616,8 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     const outFiles = positives(cache.outputs.files)
     const outWs = positives(cache.outputs.workspaceFiles ?? [])
     if (outFiles.length > 0) {
-      bucket(n.projectName).push({ node: n, globs: outFiles, reads: false })
+      const anchor = workspaceRoot === undefined ? undefined : relPosix(workspaceRoot, n.projectDir)
+      bucket(n.projectName).push({ node: n, globs: outFiles, reads: false, anchor })
       filesWriters.push(n)
     }
     if (outWs.length > 0) {
@@ -1623,7 +1646,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
         (s) => s.globs,
         (s) => s.reads,
       )) {
-        readsOutputs(memo, sides[i]!, sides[j]!, 'files')
+        readsOutputs(memo, found, sides[i]!, sides[j]!, 'files')
       }
     }
   }
@@ -1641,10 +1664,20 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       (s) => s.globs,
       (s) => s.reads,
     )) {
-      readsOutputs(memo, sides[i]!, sides[j]!, 'files')
+      readsOutputs(memo, found, sides[i]!, sides[j]!, 'files')
     }
   }
-  if (!rootReaders) return
+  if (rootReaders) readsRootedOutputs(memo, found, rooted, filesWriters, workspaceRoot)
+  refuseUnlessIgnored(found, workspaceRoot)
+}
+
+function readsRootedOutputs(
+  memo: TakeBackMemo,
+  found: Found,
+  rooted: Side[],
+  filesWriters: readonly TaskNode[],
+  workspaceRoot: string | undefined,
+): void {
   if (workspaceRoot !== undefined) {
     for (const node of filesWriters) {
       const rel = relPosix(workspaceRoot, node.projectDir)
@@ -1659,8 +1692,37 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     (s) => s.globs,
     (s) => s.reads,
   )) {
-    readsOutputs(memo, rooted[i]!, rooted[j]!, 'workspaceFiles')
+    readsOutputs(memo, found, rooted[i]!, rooted[j]!, 'workspaceFiles')
+  }
+}
+
+/** Each overlapped output, root-relative, and the refusal it meets; the first pair found per output. */
+type Found = Map<string, () => UserError>
+
+/**
+ * An output git ignores is no overlap (M, 2026-10-15): a key reads only what
+ * git lists, so such an output never reaches it. Asked of git once, for
+ * every overlapped output together; an output git cannot speak for (no work
+ * tree, a glob no few paths stand for) is refused as before. The answer
+ * holds for the lock; a run's stability gate asks git again for itself.
+ */
+function refuseUnlessIgnored(found: Found, workspaceRoot: string | undefined): void {
+  if (found.size === 0) return
+  if (workspaceRoot !== undefined) {
+    const asks = [...found.keys()].map(ignoreProbes)
+    const paths = asks.flatMap((a) => a?.paths ?? [])
+    const ignored = checkIgnoreSync(workspaceRoot, paths)
+    let listed: string[] | null | undefined
+    const pass = wholeIgnored(found.keys(), ignored, (g) => {
+      listed ??= listedSync(workspaceRoot, [
+        ...new Set(asks.flatMap((a) => (a?.deep === true ? [a.dir] : []))),
+      ])
+      return listed === null || listed.some((f) => taskGlob(g).match(f))
+    })
+    for (const [g, refuse] of found) if (!pass.has(g)) throw refuse()
+    return
   }
+  throw found.values().next().value!()
 }
 
 /**
@@ -1707,6 +1769,7 @@ function takenBack(
 
 function readsOutputs(
   memo: TakeBackMemo,
+  found: Found,
   x: Side,
   y: Side,
   field: 'files' | 'workspaceFiles',
@@ -1715,21 +1778,28 @@ function readsOutputs(
   const [reader, writer] = x.reads ? [x, y] : [y, x]
   const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
   for (const go of writer.globs) {
-    if (takenBack(memo, reader, field, go)) continue
+    const rooted =
+      writer.anchor === undefined || writer.anchor === '' ? go : `${writer.anchor}/${go}`
+    if (found.has(rooted) || takenBack(memo, reader, field, go)) continue
     for (const gi of reader.globs) {
       if (!outputsOverlap(gi, go)) continue
       const shown =
         writer.rel === undefined || writer.rel === '' ? go : go.slice(writer.rel.length + 1)
       const out = at !== '' && go.startsWith(at) ? go.slice(at.length) : go
-      throw new UserError(
-        `${reader.node.id} reads ${JSON.stringify(gi.slice(at.length))} in cache.inputs.${field}, which matches ` +
-          `${writer.node.id}'s output ${JSON.stringify(shown)} — a task's key must not read ` +
-          `another task's outputs (the dependency's key already cascades through dependsOn). ` +
-          `Exclude it: add ${JSON.stringify(`!${out}`)} to ${reader.node.id}'s ` +
-          `cache.inputs.${field}, or set run.rules.upfrontKeys: false in .vx/workspace.ts to ` +
-          `let it wait for its producer.`,
-        'VX_E_INPUT_IS_OUTPUT',
+      found.set(
+        rooted,
+        () =>
+          new UserError(
+            `${reader.node.id} reads ${JSON.stringify(gi.slice(at.length))} in cache.inputs.${field}, which matches ` +
+              `${writer.node.id}'s output ${JSON.stringify(shown)} — a task's key must not read ` +
+              `another task's outputs (the dependency's key already cascades through dependsOn). ` +
+              `Exclude it: add ${JSON.stringify(`!${out}`)} to ${reader.node.id}'s ` +
+              `cache.inputs.${field}, or set run.rules.upfrontKeys: false in .vx/workspace.ts to ` +
+              `let it wait for its producer.`,
+            'VX_E_INPUT_IS_OUTPUT',
+          ),
       )
+      break
     }
   }
 }