@vzn/vx 0.0.638 → 0.0.640

package/src/graph/index.ts

@@ -8,6 +8,15 @@ export {
   parseDependencySpec,
   type DependencySpec,
 } from './dependency-spec.js'
+export {
+  type FoldCandidate,
+  foldedDeps,
+  isGroupTask,
+  keyedDeps,
+  refuseFiltersThroughGroups,
+  selectFoldedDeps,
+} from './folds.js'
+export { computeReverseDepCount } from './priorities.js'
 export {
   type ContinueMode,
   deadServerBehind,
@@ -16,8 +25,15 @@ export {
   RestoreDemoted,
   runGraph,
   type TaskOutcome,
-  type TaskStatus,
 } from './scheduler.js'
+export {
+  type CacheSource,
+  deriveCacheSource,
+  isCacheHit,
+  isPassStatus,
+  TASK_STATUSES,
+  type TaskStatus,
+} from './task-status.js'
 export {
   buildTaskGraph,
   checkGraph,
@@ -25,7 +41,6 @@ export {
   excludeDependencies,
   expandRequested,
   type GraphRules,
-  isGroupTask,
   markSurfacedDeps,
   outputsOverlap,
   outputTakenBack,

package/src/graph/priorities.ts

@@ -85,7 +85,7 @@ export function tieredReverseDepCount(
  * dependents only (`calculateReverseDeps` in
  * `packages/nx/src/tasks-runner/utils.ts`, read 2026-09-24).
  */
-export function computeReverseDepCount(nodes: Map<string, TaskNode>): Map<string, number> {
+export function computeReverseDepCount(nodes: ReadonlyMap<string, TaskNode>): Map<string, number> {
   // Exact transitive-dependent COUNTS need closure SETS (diamonds
   // double-count under naive summing). Set-of-strings closures are
   // O(N²) entries and took 8.5s on a 1090-package, 100-layer repo;

package/src/graph/scheduler.ts

@@ -12,7 +12,9 @@ import {
   tieredReverseDepCount,
   type ScheduleStrategy,
 } from './priorities.js'
-import { isGroupTask, type TaskNode } from './task-graph.js'
+import { isGroupTask } from './folds.js'
+import type { TaskNode } from './task-graph.js'
+import type { TaskStatus } from './task-status.js'
 
 /**
  * Thrown by `execute` for a restore-tier task that turned out to have
@@ -29,19 +31,6 @@ export class RestoreDemoted extends Error {
   }
 }
 
-export type TaskStatus =
-  | 'success'
-  | 'cache-hit'
-  | 'cache-hit-remote'
-  | 'failed'
-  | 'skipped'
-  // A child killed by a shutdown signal (SIGINT/SIGTERM — e.g. Ctrl-C):
-  // the task never finished on its own terms, so it reverts to aborted —
-  // excluded from the tally and the run history. It still PROPAGATES like
-  // a failure (see `willSkip`): the child died mid-write, so its outputs
-  // are partial.
-  | 'aborted'
-
 /** What moved in a missed task's key since the last entry saved for it. */
 export interface InputChanges {
   /** How many components changed, appeared or went. 0: the same key, its entry gone. */
@@ -79,8 +68,8 @@ export interface TaskOutcome {
    * How long an `admit` policy held this task after it was ready with a
    * free worker — the wait the plugin, not the count gate, imposed. Set
    * only when a policy refused it at least once (so a run with no policy
-   * carries the field on no outcome); `--summarize` rows, the event
-   * stream and the summary footer show it.
+   * carries the field on no outcome); the event stream and the summary
+   * footer show it.
    */
   admissionHeldMs?: number
   /**
@@ -126,6 +115,12 @@ export interface TaskOutcome {
    * so a dependant that folds `hash` saves nothing either (A-12).
    */
   unkeyed?: true
+  /**
+   * This task's key folds a task with no `inputs` (or it is one): no run
+   * can derive that key again, so it neither read nor saved an entry, and a
+   * dependant that folds `hash` does neither.
+   */
+  keyless?: true
   /**
    * The run's cache policy read and wrote nothing (`--no-cache`,
    * `--cache-policy=local:`): no cache answered for this task, so a run of it is
@@ -136,7 +131,7 @@ export interface TaskOutcome {
    * On a `skipped` outcome: the task at the ROOT of what blocked it — the
    * failed (or aborted) upstream, followed through any chain of skips
    * between. Absent when the skip was fail-fast's (no upstream failed).
-   * The footer, `--summarize`, the telemetry record and the run row all
+   * The footer, the telemetry record and the run row all
    * read this one field (item 267).
    */
   blockedBy?: string
@@ -231,7 +226,7 @@ export interface TaskOutcome {
     /** Credential paths denied and left out of the grants: an agent applies the fix as given. */
     withheld?: string[]
     /**
-     * Reads of the project the task's `cache.inputs.files` does not match:
+     * Reads of the project the task's `inputs.files` does not match:
      * add them there too when the output depends on them, or a hit replays
      * output built from an older copy. Cached tasks only.
      */
@@ -313,6 +308,12 @@ export interface ScheduleOptions {
    * heuristic (the default and historically the only behavior).
    */
   priorities?: ReadonlyMap<string, number>
+  /**
+   * Called once as the run starts with a function that replaces
+   * `priorities`: the ready queues re-rank at once, over the same baseline.
+   * A `schedule` plugin's later, better weights land through it.
+   */
+  reprioritize?: (apply: (priorities: ReadonlyMap<string, number>) => void) => void
   /**
    * The baseline ranking under `priorities` (`schedule` in .vx/workspace.ts).
    * Undefined or `most-work` is the reverse-deps count above.
@@ -383,10 +384,28 @@ class ReadyHeap {
   // was two per heap level on every push and pop.
   private readonly prio: number[] = []
   private next = 0
-  constructor(private readonly priority: ReadonlyMap<string, number>) {}
+  constructor(private priority: ReadonlyMap<string, number>) {}
   get size(): number {
     return this.ids.length
   }
+  /** Re-rank every queued id under `priority`, and every later push. */
+  reprioritize(priority: ReadonlyMap<string, number>): void {
+    this.priority = priority
+    for (let i = 0; i < this.ids.length; i++) this.prio[i] = priority.get(this.ids[i]!) ?? 0
+    for (let i = (this.ids.length >> 1) - 1; i >= 0; i--) this.down(i)
+  }
+  private down(i: number): void {
+    for (;;) {
+      const l = 2 * i + 1
+      const r = 2 * i + 2
+      let best = i
+      if (l < this.ids.length && this.higher(l, best)) best = l
+      if (r < this.ids.length && this.higher(r, best)) best = r
+      if (best === i) return
+      this.swap(i, best)
+      i = best
+    }
+  }
   /** True if slot i outranks slot j (higher priority, or equal priority + earlier seq). */
   private higher(i: number, j: number): boolean {
     const pi = this.prio[i]!
@@ -446,17 +465,7 @@ class ReadyHeap {
       this.ids[0] = lastId
       this.seq[0] = lastSeq
       this.prio[0] = lastPrio
-      let i = 0
-      for (;;) {
-        const l = 2 * i + 1
-        const r = 2 * i + 2
-        let best = i
-        if (l < this.ids.length && this.higher(l, best)) best = l
-        if (r < this.ids.length && this.higher(r, best)) best = r
-        if (best === i) break
-        this.swap(i, best)
-        i = best
-      }
+      this.down(0)
     }
     return top
   }
@@ -565,6 +574,11 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
   let settledIdle = 0
   const execReady = new ReadyHeap(priority)
   const restoreReady = new ReadyHeap(priority)
+  options.reprioritize?.((weights) => {
+    const merged = mergePriorities(baseline, weights)
+    execReady.reprioritize(merged)
+    restoreReady.reprioritize(merged)
+  })
   // A restore-tier task is dep-independent (a stable hit's restore needs
   // none of its deps' output), so it's ready immediately; its `pending`
   // decrements still happen (in finishOne) but never re-enqueue it.
@@ -1020,7 +1034,7 @@ export async function runGraph(options: ScheduleOptions): Promise<Map<string, Ta
               return
             }
             // A UserError is a config/input failure (e.g. a failed
-            // `cache.inputs.runtime` command), not a vx bug — report it
+            // `inputs.runtime` command), not a vx bug — report it
             // plainly, never as an "internal error".
             let line: string
             // Out of descriptors is the environment's limit too: a stack

package/src/graph/task-graph.ts

@@ -1,7 +1,10 @@
 import type { ProjectConfig, TaskConfig, WorkspaceRules } from '../config.js'
 import {
   asTrees,
+  checkIgnoreSync,
+  ignoreProbes,
   isLiteralPattern,
+  listedSync,
   normalizeGlob,
   relPosix,
   splitNegations,
@@ -9,6 +12,7 @@ import {
   taskGlob,
   refusal,
   UserError,
+  wholeIgnored,
   wholeSubtreePrefixes,
 } from '../util/index.js'
 import type { PackageGraph, ProjectEntry } from '../workspace/index.js'
@@ -19,6 +23,7 @@ import {
   parseDependencySpec,
   type DependencySpec,
 } from './dependency-spec.js'
+import { foldedDeps, isGroupTask } from './folds.js'
 import type { TaskOutcome } from './scheduler.js'
 
 // Re-exported so existing importers keep working while the type's home
@@ -96,23 +101,9 @@ export function taskId(project: string, task: string): string {
 // graph is where every reader of a task id looks for it.
 export { splitTaskId } from '../util/index.js'
 
-/**
- * A task is a "group" if it has no `exec` — it exists only to chain
- * `dependsOn` (an umbrella for `vx run ci`). Group tasks:
- *   - never spawn a process,
- *   - never read/write the cache (it's a config error to declare one),
- *   - never appear in the run summary or `runs` analytics table,
- *   - render no framed block in the live output.
- * Six call sites used to repeat `node.config.exec === undefined`;
- * centralising the predicate prevents that check from drifting.
- */
-export function isGroupTask(node: TaskNode): boolean {
-  return node.config.exec === undefined
-}
-
-/** A keyed group: the default `build` (orchestrator/projects.ts), or a config's group with `cache`. */
+/** A keyed group: the default `build` (orchestrator/projects.ts), or a config's group with `inputs`. */
 function isKeyedGroup(task: TaskConfig): boolean {
-  return task.exec === undefined && task.cache !== undefined
+  return task.exec === undefined && task.inputs !== undefined
 }
 
 /**
@@ -507,7 +498,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
 
     // dependsOn is about which tasks to ADD to the graph, not which
     // to filter. BARE wildcards ("*"/"^*" = "everything upstream") and
-    // negation aren't meaningful here — they're cache.inputs.tasks
+    // negation aren't meaningful here — they're inputs.tasks
     // operations. PARTIAL patterns (`build.*`, `^build.*`) are legal:
     // they name a namespace of tasks to add (Nx 19.5 parity).
     if (spec.kind === 'wildcardSelf' || spec.kind === 'wildcardDeps') {
@@ -584,7 +575,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
       // task behind it would fold no upstream either.
       if (!packageGraph.edgeSource) {
         throw new UserError(
-          `${id}: ^${spec.task} needs project edges; add pnpm()/bun()/npm()/yarn() or a plugin that returns \`deps\``,
+          `${id}: ^${spec.task} needs project edges; add pnpm()/bun()/npm()/yarn() and install so its lockfile exists, or a plugin that returns \`deps\``,
           'VX_E_DEPENDS_ON',
         )
       }
@@ -785,7 +776,7 @@ export function checkGraph(
   // Under a lock an exclusive graph has no overlap to mark; a non-exclusive
   // one still needs the addition marks the walk derives.
   if (!locked || !exclusive) detectOutputCollisions(nodes, workspaceRoot, exclusive)
-  if (rules?.upfrontKeys !== false && !locked) detectInputOverlaps(nodes, workspaceRoot)
+  if (!locked) detectInputOverlaps(nodes, workspaceRoot)
 }
 
 /**
@@ -1128,6 +1119,15 @@ function detectOutputCollisions(
   }
 }
 
+/**
+ * What a task's `!` output entries take back (A-44). A glob of the other
+ * task's that one takes back whole is a path this task never cleans or
+ * captures, so the pair cannot collide there.
+ */
+function takenBackOf(n: TaskNode, field: 'files' | 'workspaceFiles'): string[] {
+  return splitNegations(n.config.cache?.outputs[field] ?? []).negative
+}
+
 /**
  * `collide` for a root-anchored output against another project's `files`
  * output rebased to the root. With an edge the dependant adds to its
@@ -1146,9 +1146,12 @@ function collideAcross(
   exclusive: boolean,
 ): void {
   if (neverWritesLocally(ws) || neverWritesLocally(files)) return
+  const wsBack = takenBackOf(ws, 'workspaceFiles')
+  const filesBack = takenBackOf(files, 'files').map((g) => (rel === '' ? g : `${rel}/${g}`))
   for (const ga of wsGlobs) {
     for (const gb of rebased) {
-      if (!outputsOverlap(ga, gb)) continue
+      if (!outputsOverlap(ga, gb) || outputTakenBack(gb, wsBack) || outputTakenBack(ga, filesBack))
+        continue
       const head =
         `${ws.id} declares the output ${JSON.stringify(ga)} in cache.outputs.workspaceFiles, ` +
         `inside ${files.id}'s ${JSON.stringify(gb.slice(rel === '' ? 0 : rel.length + 1))} in ` +
@@ -1405,9 +1408,12 @@ function collide(
   exclusive: boolean,
 ): void {
   if (neverWritesLocally(a) || neverWritesLocally(b)) return
+  const aBack = takenBackOf(a, field)
+  const bBack = takenBackOf(b, field)
   for (const ga of aGlobs ?? []) {
     for (const gb of bGlobs ?? []) {
-      if (!outputsOverlap(ga, gb)) continue
+      if (!outputsOverlap(ga, gb) || outputTakenBack(gb, aBack) || outputTakenBack(ga, bBack))
+        continue
       const head =
         `${a.id} and ${b.id} both declare the output ${JSON.stringify(ga)}` +
         (ga === gb ? '' : ` / ${JSON.stringify(gb)}`) +
@@ -1478,10 +1484,11 @@ export function outputTakenBack(output: string, negatives: readonly string[]): b
  */
 function refuseSelfClean(node: TaskNode): void {
   const cache = node.config.cache
-  if (cache === undefined) return
+  const declared = node.config.inputs
+  if (cache === undefined || declared === undefined) return
   for (const field of ['files', 'workspaceFiles'] as const) {
-    if (!coversAny(cache.inputs[field], cache.outputs[field])) continue
-    const inputs = splitNegations(cache.inputs[field] ?? [])
+    if (!coversAny(declared[field], cache.outputs[field])) continue
+    const inputs = splitNegations(declared[field] ?? [])
     const out = splitNegations(cache.outputs[field] ?? [])
     const outputs = out.positive
     if (outputs.length === 0) continue
@@ -1500,7 +1507,7 @@ function refuseSelfClean(node: TaskNode): void {
       if (outputTakenBack(gi, out.negative)) continue
       if (!outputTakenBack(gi, near)) continue
       throw new UserError(
-        `${node.id}: every file ${JSON.stringify(gi)} in cache.inputs.${field} selects is also ` +
+        `${node.id}: every file ${JSON.stringify(gi)} in inputs.${field} selects is also ` +
           `its own output — vx removes a task's outputs before it runs, so the task would ` +
           `delete its own sources. A task that rewrites files in place (a formatter) declares ` +
           `no outputs.`,
@@ -1550,16 +1557,19 @@ interface Side {
   reads: boolean
   /** The project's root-relative dir for rebased `files` globs. */
   rel?: string
+  /** The root-relative dir project-relative `globs` sit in, for git. */
+  anchor?: string | undefined
 }
 
 /**
- * `run.rules.upfrontKeys` (X-54): refuse a task whose input globs can match
- * another task's declared outputs. Such a key reads bytes a producer writes
- * this run, so it is not known until the producer ran (`stable-keys.ts`
- * keeps it waiting); refused, every key reads only what no task writes and
- * can be derived before anything runs (M, 2026-10-07: "hash ahead of time,
- * not waterfall"). A dependency's own key already cascades through
- * `dependsOn`, so the bytes it wrote add nothing a key needs.
+ * Refuse a task whose input globs can match another task's declared
+ * outputs (X-54; no opt-out, owner 2026-10-16). Such a key reads bytes a
+ * producer writes this run, so it is not known until the producer ran;
+ * refused, every key reads only what no task writes and can be derived
+ * before anything runs (M, 2026-10-07: "hash ahead of time, not
+ * waterfall"). A dependency's own key already cascades through
+ * `dependsOn`, so the bytes it wrote add nothing a key needs; the one
+ * exception is `refuseOverlaps`'s unfolded dependency.
  *
  * Proven overlaps only (`outputsOverlap`), as for outputs: a pair the rule
  * cannot decide passes, and the stability gate still keeps it waiting. The
@@ -1583,6 +1593,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   let projectReaders = false
   let rootReaders = false
   const memo: TakeBackMemo = { bySide: new Map(), byList: new Map() }
+  const found: Found = new Map()
   const bucket = (name: string): Side[] => {
     let list = byProject.get(name)
     if (list === undefined) byProject.set(name, (list = []))
@@ -1590,11 +1601,13 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   }
   for (const n of nodes.values()) {
     const cache = n.config.cache
-    if (cache === undefined) continue
-    const outFiles = positives(cache.outputs.files)
-    const outWs = positives(cache.outputs.workspaceFiles ?? [])
+    const inputs = n.config.inputs
+    if (inputs === undefined) continue
+    const outFiles = positives(cache?.outputs.files ?? [])
+    const outWs = positives(cache?.outputs.workspaceFiles ?? [])
     if (outFiles.length > 0) {
-      bucket(n.projectName).push({ node: n, globs: outFiles, reads: false })
+      const anchor = workspaceRoot === undefined ? undefined : relPosix(workspaceRoot, n.projectDir)
+      bucket(n.projectName).push({ node: n, globs: outFiles, reads: false, anchor })
       filesWriters.push(n)
     }
     if (outWs.length > 0) {
@@ -1603,10 +1616,11 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       wsWriters.push(side)
     }
     if (isGroupTask(n)) continue
-    const inFiles = positives(cache.inputs.files)
-    const inWs = positives(cache.inputs.workspaceFiles ?? [])
+    const inFiles = positives(inputs.files)
+    const inWs = positives(inputs.workspaceFiles ?? [])
     if (inFiles.length > 0) {
-      bucket(n.projectName).push({ node: n, globs: inFiles, reads: true })
+      const anchor = workspaceRoot === undefined ? undefined : relPosix(workspaceRoot, n.projectDir)
+      bucket(n.projectName).push({ node: n, globs: inFiles, reads: true, anchor })
       filesReaders.push(n)
       projectReaders = true
     }
@@ -1623,7 +1637,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
         (s) => s.globs,
         (s) => s.reads,
       )) {
-        readsOutputs(memo, sides[i]!, sides[j]!, 'files')
+        readsOutputs(memo, found, sides[i]!, sides[j]!, 'files')
       }
     }
   }
@@ -1631,7 +1645,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     const sides = [...wsWriters]
     for (const node of filesReaders) {
       const rel = relPosix(workspaceRoot, node.projectDir)
-      const globs = positives(node.config.cache!.inputs.files).map((g) =>
+      const globs = positives(node.config.inputs!.files).map((g) =>
         rel === '' ? g : `${rel}/${g}`,
       )
       sides.push({ node, globs, reads: true, rel })
@@ -1641,10 +1655,20 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       (s) => s.globs,
       (s) => s.reads,
     )) {
-      readsOutputs(memo, sides[i]!, sides[j]!, 'files')
+      readsOutputs(memo, found, sides[i]!, sides[j]!, 'files')
     }
   }
-  if (!rootReaders) return
+  if (rootReaders) readsRootedOutputs(memo, found, rooted, filesWriters, workspaceRoot)
+  refuseOverlaps(found, nodes, workspaceRoot)
+}
+
+function readsRootedOutputs(
+  memo: TakeBackMemo,
+  found: Found,
+  rooted: Side[],
+  filesWriters: readonly TaskNode[],
+  workspaceRoot: string | undefined,
+): void {
   if (workspaceRoot !== undefined) {
     for (const node of filesWriters) {
       const rel = relPosix(workspaceRoot, node.projectDir)
@@ -1659,10 +1683,104 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     (s) => s.globs,
     (s) => s.reads,
   )) {
-    readsOutputs(memo, rooted[i]!, rooted[j]!, 'workspaceFiles')
+    readsOutputs(memo, found, rooted[i]!, rooted[j]!, 'workspaceFiles')
   }
 }
 
+/** One reader of another task's output: the reader's glob's fixed prefix, root-relative. */
+interface Overlap {
+  reader: TaskNode
+  writer: TaskNode
+  prefix: string
+  refuse: () => UserError
+}
+
+/** Each overlapped output, root-relative, and every reader of it. */
+type Found = Map<string, Overlap[]>
+
+/**
+ * Which overlaps stand. A reader may read the outputs of a task in its
+ * `dependsOn` closure whose key its own does not fold (it sets
+ * `inputs.tasks` and leaves the producer out, also through the tasks it
+ * folds): its key waits for the producer and hashes the bytes (owner,
+ * 2026-10-16). Otherwise an output git ignores whole is no overlap (M,
+ * 2026-10-15), a key reading only what git lists, unless the reader's
+ * glob starts in an ignored path (`dist/**`): naming it is asking for it.
+ * Git is asked once, for every output and prefix together; one it cannot
+ * speak for is refused. The answer holds for the lock; a run's stability
+ * gate asks git again for itself.
+ */
+function refuseOverlaps(
+  found: Found,
+  nodes: ReadonlyMap<string, TaskNode>,
+  workspaceRoot: string | undefined,
+): void {
+  if (found.size === 0) return
+  const reads = dependencyReads(nodes)
+  const left = new Map<string, Overlap[]>()
+  for (const [g, list] of found) {
+    const refused = list.filter((o) => !reads(o.reader, o.writer))
+    if (refused.length > 0) left.set(g, refused)
+  }
+  if (left.size === 0) return
+  if (workspaceRoot === undefined) throw left.values().next().value![0]!.refuse()
+  const asks = [...left.keys()].map(ignoreProbes)
+  const prefixes = new Set<string>()
+  for (const list of left.values()) {
+    for (const o of list) if (o.prefix !== '') prefixes.add(o.prefix).add(`${o.prefix}/`)
+  }
+  const ignored = checkIgnoreSync(workspaceRoot, [
+    ...asks.flatMap((a) => a?.paths ?? []),
+    ...prefixes,
+  ])
+  let listed: string[] | null | undefined
+  const pass = wholeIgnored(left.keys(), ignored, (g) => {
+    listed ??= listedSync(workspaceRoot, [
+      ...new Set(asks.flatMap((a) => (a?.deep === true ? [a.dir] : []))),
+    ])
+    return listed === null || listed.some((f) => taskGlob(g).match(f))
+  })
+  const named = (o: Overlap): boolean =>
+    o.prefix !== '' && ignored !== null && (ignored.has(o.prefix) || ignored.has(`${o.prefix}/`))
+  for (const [g, list] of left) {
+    for (const o of list) if (!pass.has(g) || named(o)) throw o.refuse()
+  }
+}
+
+/**
+ * Whether a reader may read a writer's outputs: the writer is in the
+ * reader's `dependsOn` closure and not in its folded closure. Each closure
+ * walked once per reader.
+ */
+function dependencyReads(
+  nodes: ReadonlyMap<string, TaskNode>,
+): (reader: TaskNode, writer: TaskNode) => boolean {
+  const nodeOf = (id: string): TaskNode => nodes.get(id)!
+  const deps = new Map<string, Set<string>>()
+  const folded = new Map<string, Set<string>>()
+  const closure = (
+    memo: Map<string, Set<string>>,
+    root: TaskNode,
+    next: (n: TaskNode) => Iterable<TaskNode>,
+  ): Set<string> => {
+    let out = memo.get(root.id)
+    if (out !== undefined) return out
+    out = new Set()
+    const stack = [...next(root)]
+    while (stack.length > 0) {
+      const n = stack.pop()!
+      if (out.has(n.id)) continue
+      out.add(n.id)
+      stack.push(...next(n))
+    }
+    memo.set(root.id, out)
+    return out
+  }
+  return (reader, writer) =>
+    closure(deps, reader, (n) => n.deps.flatMap((d) => nodes.get(d) ?? [])).has(writer.id) &&
+    !closure(folded, reader, (n) => foldedDeps(n, nodeOf).map((c) => c.node)).has(writer.id)
+}
+
 /**
  * Whether a reader's take-back list covers an output glob, asked once per
  * list and glob: a Turbo-mapped repo gives two thousand readers one
@@ -1683,16 +1801,15 @@ function takenBack(
 ): boolean {
   let tb = memo.bySide.get(reader)
   if (tb === undefined) {
-    const cache = reader.node.config.cache!
+    const inputs = reader.node.config.inputs!
+    const cache = reader.node.config.cache
     // A reader rebased to the root (X-135) speaks in its project's terms.
     const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
     // What the reader's key never reads: its `!` entries and its own outputs.
     const list = [
+      ...splitNegations(field === 'files' ? inputs.files : (inputs.workspaceFiles ?? [])).negative,
       ...splitNegations(
-        field === 'files' ? cache.inputs.files : (cache.inputs.workspaceFiles ?? []),
-      ).negative,
-      ...splitNegations(
-        field === 'files' ? cache.outputs.files : (cache.outputs.workspaceFiles ?? []),
+        field === 'files' ? (cache?.outputs.files ?? []) : (cache?.outputs.workspaceFiles ?? []),
       ).positive,
     ].map((g) => at + g)
     const key = list.join('\0')
@@ -1707,6 +1824,7 @@ function takenBack(
 
 function readsOutputs(
   memo: TakeBackMemo,
+  found: Found,
   x: Side,
   y: Side,
   field: 'files' | 'workspaceFiles',
@@ -1714,22 +1832,36 @@ function readsOutputs(
   if (x.reads === y.reads || x.node === y.node) return
   const [reader, writer] = x.reads ? [x, y] : [y, x]
   const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
+  const readerAt = reader.anchor === undefined || reader.anchor === '' ? '' : `${reader.anchor}/`
   for (const go of writer.globs) {
+    const rooted =
+      writer.anchor === undefined || writer.anchor === '' ? go : `${writer.anchor}/${go}`
+    let list = found.get(rooted)
+    if (list?.some((o) => o.reader === reader.node) === true) continue
     if (takenBack(memo, reader, field, go)) continue
     for (const gi of reader.globs) {
       if (!outputsOverlap(gi, go)) continue
       const shown =
         writer.rel === undefined || writer.rel === '' ? go : go.slice(writer.rel.length + 1)
       const out = at !== '' && go.startsWith(at) ? go.slice(at.length) : go
-      throw new UserError(
-        `${reader.node.id} reads ${JSON.stringify(gi.slice(at.length))} in cache.inputs.${field}, which matches ` +
-          `${writer.node.id}'s output ${JSON.stringify(shown)} — a task's key must not read ` +
-          `another task's outputs (the dependency's key already cascades through dependsOn). ` +
-          `Exclude it: add ${JSON.stringify(`!${out}`)} to ${reader.node.id}'s ` +
-          `cache.inputs.${field}, or set run.rules.upfrontKeys: false in .vx/workspace.ts to ` +
-          `let it wait for its producer.`,
-        'VX_E_INPUT_IS_OUTPUT',
-      )
+      const prefix = staticPrefix(readerAt + gi)
+      if (list === undefined) found.set(rooted, (list = []))
+      list.push({
+        reader: reader.node,
+        writer: writer.node,
+        prefix: prefix === '.' ? '' : prefix,
+        refuse: () =>
+          new UserError(
+            `${reader.node.id} reads ${JSON.stringify(gi.slice(at.length))} in inputs.${field}, which matches ` +
+              `${writer.node.id}'s output ${JSON.stringify(shown)} — a task's key must not read ` +
+              `the outputs of a task it does not depend on, or whose key it already folds. ` +
+              `Exclude it: add ${JSON.stringify(`!${out}`)} to ${reader.node.id}'s ` +
+              `inputs.${field}, or depend on ${writer.node.id} and leave it out of ` +
+              `${reader.node.id}'s inputs.tasks, so its key hashes those bytes instead.`,
+            'VX_E_INPUT_IS_OUTPUT',
+          ),
+      })
+      break
     }
   }
 }