@vzn/vx 0.0.639 → 0.0.640

package/src/orchestrator/run-report.ts

@@ -1,6 +1,9 @@
 // The report every plugin's teardown reads, and the run's own bytes kept
 // in a remote that takes its writes (owner 2026-10-15): a failed task's
-// log and the files its outputs left, an uncached task's log.
+// log and the files its outputs left (`cache.upload.failures`), and the
+// log of a task that saved no entry. Each task's bytes leave when it ends,
+// off its path, like its entry's upload (owner 2026-10-16); the run only
+// waits for them where it waits for every upload.
 
 import {
   packRunOutputs,
@@ -14,17 +17,27 @@ import { relPosix } from '../util/index.js'
 import { decodeOutputLog } from './output-log.js'
 import type { RunReport, RunReportTask } from './plugin.js'
 
-export interface RunReportArgs {
+/** Stores one run entry; resolves whether a remote kept it. */
+export type KeepRunEntry = (name: string, bytes: Uint8Array) => Promise<boolean>
+
+export interface RunKeeperArgs {
   readonly runId: string
-  readonly commit: string | null
-  readonly ciRun: CiContext
-  readonly ok: boolean
   readonly workspaceRoot: string
   readonly nestedDirsByProject: ReadonlyMap<string, string[]>
-  /** Stores one run entry; undefined when no remote takes the run's writes. */
-  readonly keep: ((name: string, bytes: Uint8Array) => Promise<boolean>) | undefined
+  readonly keep: KeepRunEntry
+  /** Whether a failed task's log and outputs are kept (`cache.upload.failures`). */
+  readonly failures: boolean
+}
+
+/** Whether a run on CI or off it keeps failures, by `cache.upload.failures` (default `'ci'`). */
+export function keepsFailures(where: unknown, ci: boolean): boolean {
+  const at = where ?? 'ci'
+  return at === 'always' || (at === 'ci') === ci
 }
 
+/** Concurrent run-entry writes; more queue. */
+const KEEP_CONCURRENCY = 8
+
 /** The files `node`'s declared outputs match on disk now, workspace-relative and sorted. */
 async function outputsLeft(
   node: TaskNode,
@@ -40,52 +53,117 @@ async function outputsLeft(
   return [...new Set([...own, ...ws].map((p) => relPosix(workspaceRoot, p)))].sort()
 }
 
-export async function keepRunBytes(
-  final: readonly TaskOutcome[],
-  args: RunReportArgs,
-): Promise<RunReport> {
-  const { keep, runId, workspaceRoot } = args
-  const tasks: RunReportTask[] = []
-  const work: (() => Promise<void>)[] = []
-  for (const o of final) {
-    if (isGroupTask(o.node)) continue
-    const task: { -readonly [K in keyof RunReportTask]: RunReportTask[K] } = {
-      id: o.node.id,
-      status: o.status,
-      durationMs: Math.round(o.durationMs),
-      ...(o.hash !== undefined ? { key: o.hash } : {}),
+/** Keeps each task's run bytes as it ends, and names them in the run's report. */
+export class RunKeeper {
+  private readonly kept = new Map<string, { log?: string; outputs?: string }>()
+  private readonly queue: (() => Promise<void>)[] = []
+  private readonly pending = new Set<Promise<void>>()
+  private active = 0
+  private stopped = false
+
+  constructor(private readonly args: RunKeeperArgs) {}
+
+  /** A task ended: queue what of it the run keeps. */
+  taskDone(o: TaskOutcome): void {
+    if (this.stopped || isGroupTask(o.node)) return
+    const { runId, workspaceRoot } = this.args
+    const id = o.node.id
+    const slot = (): { log?: string; outputs?: string } => {
+      let s = this.kept.get(id)
+      if (s === undefined) this.kept.set(id, (s = {}))
+      return s
     }
-    tasks.push(task)
-    if (keep === undefined) continue
     const runLog = o.runLog
     if (runLog !== undefined) {
-      work.push(async () => {
-        const text = decodeOutputLog(runLog)
-          .map((c) => c.text)
-          .join('')
-        if (text.length === 0) return
-        const name = runEntryName(runId, o.node.id, 'log')
-        if (await keep(name, new TextEncoder().encode(text))) task.log = name
+      const text = decodeOutputLog(runLog)
+        .map((c) => c.text)
+        .join('')
+      if (text.length > 0) {
+        const name = runEntryName(runId, id, 'log')
+        const bytes = new TextEncoder().encode(text)
+        this.enqueue(async () => {
+          if (await this.args.keep(name, bytes)) slot().log = name
+        })
+      }
+    }
+    if (this.args.failures && o.status === 'failed' && o.where === undefined) {
+      // Read now: a later task may write where this one's outputs lie.
+      const packed = outputsLeft(
+        o.node,
+        workspaceRoot,
+        this.args.nestedDirsByProject.get(o.node.projectName) ?? [],
+      ).then((paths) => packRunOutputs(workspaceRoot, paths))
+      const name = runEntryName(runId, id, 'outputs')
+      this.enqueue(async () => {
+        const bytes = await packed
+        if (bytes !== null && (await this.args.keep(name, bytes))) slot().outputs = name
       })
     }
-    if (o.status === 'failed' && o.where === undefined) {
-      work.push(async () => {
-        const bytes = await packRunOutputs(
-          workspaceRoot,
-          await outputsLeft(
-            o.node,
-            workspaceRoot,
-            args.nestedDirsByProject.get(o.node.projectName) ?? [],
-          ),
-        )
-        if (bytes === null) return
-        const name = runEntryName(runId, o.node.id, 'outputs')
-        if (await keep(name, bytes)) task.outputs = name
+  }
+
+  /** Resolves once every queued write has settled, or the run was stopped. */
+  async settled(): Promise<void> {
+    while (!this.stopped && this.pending.size > 0) await Promise.all(this.pending)
+  }
+
+  /** A stopped run starts no more writes and stops waiting on those in flight. */
+  stop(): void {
+    this.stopped = true
+    this.queue.length = 0
+  }
+
+  /** What was kept of each task, by id, for `reportOf`. */
+  keptOf(id: string): { log?: string; outputs?: string } | undefined {
+    return this.kept.get(id)
+  }
+
+  private enqueue(job: () => Promise<void>): void {
+    let done!: () => void
+    const p = new Promise<void>((resolve) => (done = resolve))
+    this.pending.add(p)
+    this.queue.push(async () => {
+      try {
+        if (!this.stopped) await job()
+      } catch {
+        // a record, never the run's verdict
+      } finally {
+        this.pending.delete(p)
+        done()
+      }
+    })
+    this.pump()
+  }
+
+  private pump(): void {
+    while (this.active < KEEP_CONCURRENCY && this.queue.length > 0) {
+      const job = this.queue.shift()!
+      this.active++
+      void job().finally(() => {
+        this.active--
+        this.pump()
       })
     }
   }
-  for (let i = 0; i < work.length; i += 8) {
-    await Promise.all(work.slice(i, i + 8).map((w) => w()))
+}
+
+/** The report: every task, with the names of what `keeper` kept of it. */
+export function reportOf(
+  final: readonly TaskOutcome[],
+  run: { runId: string; commit: string | null; ciRun: CiContext; ok: boolean },
+  keeper: RunKeeper | undefined,
+): RunReport {
+  const tasks: RunReportTask[] = []
+  for (const o of final) {
+    if (isGroupTask(o.node)) continue
+    const kept = keeper?.keptOf(o.node.id)
+    tasks.push({
+      id: o.node.id,
+      status: o.status,
+      durationMs: Math.round(o.durationMs),
+      ...(o.hash !== undefined ? { key: o.hash } : {}),
+      ...(kept?.log !== undefined ? { log: kept.log } : {}),
+      ...(kept?.outputs !== undefined ? { outputs: kept.outputs } : {}),
+    })
   }
-  return { runId, commit: args.commit, ciRun: args.ciRun, ok: args.ok, tasks }
+  return { runId: run.runId, commit: run.commit, ciRun: run.ciRun, ok: run.ok, tasks }
 }

package/src/orchestrator/run-steps.ts

@@ -0,0 +1,57 @@
+// The steps a run did not wait on (`vx:prefetch`), for `vx last` (M,
+// 2026-10-16): they never show in a run's output. One file per run that
+// had one, `<cacheDir>/steps/<runId>.json`, the newest 50 kept, as
+// run-failures.ts keeps failed output: files, not cache.db, so the index
+// layout stays as it was. A run with none writes nothing.
+
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { isFsRefusal } from '../util/index.js'
+
+/** Runs whose background steps are kept; run ids are UUIDv7, so names sort by age. */
+const KEPT = 50
+
+/** One of vx's own steps that ran beside the tasks. */
+export interface RunStep {
+  id: string
+  durationMs: number
+  ok: boolean
+}
+
+const dirOf = (cacheDir: string): string => path.join(cacheDir, 'steps')
+
+/** Keep `steps` for `runId`; a refused write costs only them. */
+export function writeRunSteps(
+  cacheDir: string,
+  runId: string,
+  steps: readonly RunStep[],
+  warn: (message: string) => void,
+): void {
+  if (steps.length === 0) return
+  try {
+    const dir = dirOf(cacheDir)
+    mkdirSync(dir, { recursive: true })
+    const file = path.join(dir, `${runId}.json`)
+    const tmp = `${file}.${process.pid}.tmp`
+    writeFileSync(tmp, JSON.stringify(steps))
+    renameSync(tmp, file)
+    const names = readdirSync(dir)
+      .filter((n) => n.endsWith('.json'))
+      .sort()
+    for (const n of names.slice(0, -KEPT)) rmSync(path.join(dir, n), { force: true })
+  } catch (err) {
+    if (!isFsRefusal(err)) throw err
+    warn(`[vx] background steps not kept: ${err.message} — the verdict above stands`)
+  }
+}
+
+/** The background steps `runId` kept; none when it had none or they are gone. */
+export function runSteps(cacheDir: string, runId: string): RunStep[] {
+  try {
+    return JSON.parse(
+      readFileSync(path.join(dirOf(cacheDir), `${runId}.json`), 'utf8'),
+    ) as RunStep[]
+  } catch {
+    return []
+  }
+}

package/src/orchestrator/run.ts

@@ -76,9 +76,10 @@ import {
   warnOf,
 } from '../report/index.js'
 import { installPlugins, PluginSetupError, type RunReport } from './plugin.js'
-import { keepRunBytes } from './run-report.js'
+import { keepsFailures, reportOf, RunKeeper } from './run-report.js'
 import { buildAdmission, executorDemand, resolveExecutors, teardownPlugins } from './plugin-host.js'
 import { createSteps } from './steps.js'
+import { writeRunSteps } from './run-steps.js'
 import { subscribeTelemetry, type TelemetryHandle } from './telemetry-host.js'
 import { claimOutput, guardedOutput } from './output-host.js'
 import { assembleRunSummary } from './telemetry.js'
@@ -358,7 +359,8 @@ async function runOnBus(
   takeOutput?: (claimed: { logger: Logger; owner: string }) => void,
 ): Promise<RunSummary> {
   const log = busLogger(bus)
-  const { step, stepSync } = createSteps(log, showsSteps)
+  const steps = createSteps(log, showsSteps)
+  const { step, stepSync } = steps
   // A server's output goes through a cell of its own: a later watch cycle
   // that keeps the server points it at that cycle's bus (`RunOptions.keep`).
   const serverOuts = new Map<string, { bus: EventBus }>()
@@ -450,7 +452,25 @@ async function runOnBus(
   const runId = ulid()
   const head = captureGitContext(prepared.workspaceRoot)
   const ciContext = detectCi(process.env)
-  const keepRunLog = prepared.keepRunEntry !== undefined
+  const keepRun =
+    prepared.keepRunEntry === undefined
+      ? undefined
+      : {
+          failures: keepsFailures(
+            resolveSetting('cache.upload.failures', prepared.workspaceConfig).value,
+            ciContext.ci,
+          ),
+        }
+  const keeper =
+    prepared.keepRunEntry === undefined || keepRun === undefined
+      ? undefined
+      : new RunKeeper({
+          runId,
+          workspaceRoot: prepared.workspaceRoot,
+          nestedDirsByProject: prepared.nestedDirsByProject,
+          keep: prepared.keepRunEntry,
+          failures: keepRun.failures,
+        })
   try {
     disposePlugins = await installPlugins({
       plugins: prepared.plugins,
@@ -579,6 +599,7 @@ async function runOnBus(
     onStop: () => {
       stopRuntimeProbes(hashCache.runtime, hashCache.workspaceRuntime)
       cache.stopUploads?.()
+      keeper?.stop()
     },
   })
   const { liveChildren, persistentRegistry } = stop
@@ -823,7 +844,7 @@ async function runOnBus(
     // unchanged (no upfront key pass, no local probing).
     let prefetchDone: Promise<void> = Promise.resolve()
     if (prepared.hasRemoteLayer) {
-      prefetchDone = step('vx:prefetch', () =>
+      prefetchDone = steps.background('vx:prefetch', () =>
         startRemotePrefetch({
           nodes,
           cache,
@@ -938,7 +959,7 @@ async function runOnBus(
     if (cleanOutputs !== undefined) scope.cleanOutputs = cleanOutputs
     if (telemetry?.track !== undefined) scope.track = telemetry.track
     if (explainMiss !== undefined) scope.explainMiss = explainMiss
-    if (keepRunLog) scope.keepRunLog = true
+    if (keepRun !== undefined) scope.keepRun = keepRun
     if (sandboxArmer !== null) scope.armSandbox = () => sandboxArmer.arm()
     const argsOf = executeArgsOf(scope, {
       log: (node) => (node.config.exec?.persistent !== undefined ? serverLog(node.id) : log),
@@ -986,11 +1007,22 @@ async function runOnBus(
     mark('classify + probe')
     // A run whose every task is a confirmed local hit dispatches only
     // restores, which no weight orders: the `schedule` stage is not asked.
+    // A plugin's later weights (`ctx.refine`) re-rank the ready queues
+    // while the graph runs; any that land before it starts, at its start.
+    let reprioritize: ((weights: ReadonlyMap<string, number>) => void) | undefined
+    let refinedEarly: ReadonlyMap<string, number> | undefined
+    let graphOver = false
     const priorities = [...nodes.values()].every(
       (n) => n.config.exec?.command === undefined || shortCircuit.restoreTier.has(n.id),
     )
       ? new Map<string, number>()
-      : await step('vx:schedule', () => prepared.priorities())
+      : await prepared.priorities({
+          step,
+          refined: (merged) => {
+            if (reprioritize !== undefined) reprioritize(merged)
+            else if (!graphOver) refinedEarly = merged
+          },
+        })
     mark('schedule')
     // Judged as each task finishes, against the history BEFORE this run's
     // rows land, so the row that prints next carries the verdict: nothing
@@ -1047,6 +1079,7 @@ async function runOnBus(
         if (cacheOff) o.cacheOff = true
         taint.settled(o)
         judgeFlaky(o)
+        keeper?.taskDone(o)
         log.taskComplete(o.node, o)
         narrowDemand(o.node.id)
       },
@@ -1070,7 +1103,7 @@ async function runOnBus(
       ...(options.continueMode !== 'always' && taintSeeds.size === 0
         ? {
             settleNow: (node: TaskNode, upstream: TaskOutcome[]) =>
-              isGroupTask(node) && node.config.cache === undefined
+              isGroupTask(node) && node.config.inputs === undefined
                 ? unkeyedGroupOutcome(
                     node,
                     keyUpstream(node, upstream),
@@ -1083,6 +1116,10 @@ async function runOnBus(
       // A `schedule` plugin's weights; the scheduler keeps its structural
       // baseline as the tie-break. Empty map → baseline only.
       ...(priorities.size > 0 ? { priorities } : {}),
+      reprioritize: (apply) => {
+        if (refinedEarly !== undefined) apply(refinedEarly)
+        reprioritize = apply
+      },
       // The baseline under them; `most-work` when the workspace names none.
       ...(options.schedule !== undefined ? { strategy: options.schedule } : {}),
       // Local short-circuit: confirmed stable local hits the scheduler
@@ -1091,6 +1128,8 @@ async function runOnBus(
       restoreTier: shortCircuit.restoreTier,
     })
     stop.graphDone()
+    reprioritize = undefined
+    graphOver = true
 
     // Which persistent children outlive the graph, and the bounded SIGTERM
     // of the rest, before the summary prints. Scoped to the real CLI
@@ -1250,22 +1289,13 @@ async function runOnBus(
     // nothing the suite could see, because this gate is the rule.
     await step('vx:uploads', async () => {
       await prefetchDone
-      await cache.drainUploads?.()
+      await Promise.all([cache.drainUploads?.(), keeper?.settled()])
     })
+    writeRunSteps(prepared.cacheDir, runId, steps.ended, warnOf(log))
     // An upload that failed after the rows went in: its row says so too.
     if (prepared.localCache.uploads.failed > 0 && stop.stoppedBy === undefined && !historyAfterWait)
       recordHistory(() => recordLateRemoteErrors(prepared.localCache, records.runs, runId))
-    const report = await step('vx:keep-run', () =>
-      keepRunBytes(list, {
-        runId,
-        commit: head.commitSha,
-        ciRun: ciContext,
-        ok,
-        workspaceRoot: prepared.workspaceRoot,
-        nestedDirsByProject: prepared.nestedDirsByProject,
-        keep: prepared.keepRunEntry,
-      }),
-    )
+    const report = reportOf(list, { runId, commit: head.commitSha, ciRun: ciContext, ok }, keeper)
     // Hand the per-run summary to the telemetry sinks + drain them. Only
     // when a sink is active (telemetry !== undefined) — otherwise this
     // whole block is skipped and the run is byte-identical to before.
@@ -1285,7 +1315,7 @@ async function runOnBus(
       })
       telemetry.emitSummary(summary)
       const sinks = telemetry
-      await step('vx:telemetry', () => sinks.flush())
+      await sinks.flush(step)
     }
     // End-of-run plugin lifecycle: each plugin's teardown(). Crash-isolated
     // + time-bounded inside teardownPlugins, so a faulty plugin can neither
@@ -1477,7 +1507,7 @@ function noneAffected(prepared: PreparedRun, options: RunOptions): string {
  * task. Used by `--dry`.
  *
  * Side-effects are limited to opening + closing the local Cache handle
- * (and running `cache.inputs.runtime` probe commands, which key
+ * (and running `inputs.runtime` probe commands, which key
  * derivation requires). Cache probing is the byte-free `cache.has()`
  * existence check — no artifact download, no ingest, no accessed_at bump.
  */

package/src/orchestrator/sandbox-fix.ts

@@ -85,7 +85,7 @@ export function sandboxFix(
   projectDir: string,
   mask: (text: string) => string = (t) => t,
   /**
-   * The task's `cache.inputs.files`, undefined when it does not cache: a
+   * The task's `inputs.files`, undefined when it does not cache: a
    * write under one is granted exactly, and a read of the project no glob
    * matches is named for the key too.
    */

package/src/orchestrator/sandbox-request.ts

@@ -163,7 +163,7 @@ export function prepareSandbox(nodes: Iterable<TaskNode>): SandboxArmer | null {
  * cached path (through the executor) and the persistent path (spawned here).
  *
  * The user's grants derive NOTHING from `cache` (owner, 2026-09-05). Those
- * are two different questions: `cache.inputs` says what INVALIDATES the
+ * are two different questions: `inputs` says what INVALIDATES the
  * task, `sandbox.allow` says what it may TOUCH. Deriving one from the other
  * coupled them in both directions — a declaration added for caching
  * silently widened the sandbox, and a path the task needed had to be
@@ -476,7 +476,7 @@ export function withheldLinkLine(taskId: string, w: WithheldLink): string {
     `${w.name}, so an edit there would not re-run it. Add a \`dependsOn\` edge that ` +
     `reaches one (\`^build\` where ${w.name}#build keys its sources, or a \`source\` task: ` +
     `\`${w.name}#source\`), or grant and key the files yourself (\`allow.read\` plus ` +
-    `\`cache.inputs.workspaceFiles\`).`
+    `\`inputs.workspaceFiles\`).`
   )
 }
 

package/src/orchestrator/stable-keys.ts

@@ -5,13 +5,19 @@
 // out so the two callers can never drift on the stability gate.
 //
 // A task's key is "stable" only if its inputs can't be altered by an
-// upstream's outputs (a `cache.inputs.files` glob that could match a
+// upstream's outputs (a `inputs.files` glob that could match a
 // sibling's declared output has a PRELIMINARY key until that upstream
 // runs — probing it would target the wrong artifact). Unstable tasks
 // fall back to lazy read-through in execute-task, which is always
 // correct. The check is conservative: when unsure, treat as unstable.
 
-import { isGroupTask, outputTakenBack, type TaskNode, type TaskOutcome } from '../graph/index.js'
+import {
+  foldedDeps,
+  isGroupTask,
+  outputTakenBack,
+  type TaskNode,
+  type TaskOutcome,
+} from '../graph/index.js'
 import type { CacheLayer, GitFilesCache } from '../cache/index.js'
 import {
   checkIgnore,
@@ -23,7 +29,6 @@ import {
   wholeIgnored,
 } from '../util/index.js'
 import { commandWriteReach, mayWriteFingerprint, undeclaredWriteReach } from './sandbox-request.js'
-import { foldedDeps } from './keyed-projects.js'
 import {
   computeGroupHash,
   computeTaskHash,
@@ -129,12 +134,12 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
   const unfoldedById = new Map<string, ProjectSet>()
   const wsRewriters = new Set<string>()
   // A cached rewriter matters only to a key that leaves a dependency's key
-  // out: a `cache.inputs.tasks` filter. With none in the graph every edge
+  // out: a `inputs.tasks` filter. With none in the graph every edge
   // folds and the sets above stay empty, so they are not built (about 2 ms,
   // median, of a 27 ms memoised walk over the 3,000-task bench; item 750).
   let anyUnfolded = false
   for (const n of args.nodes.values()) {
-    if (n.config.cache?.inputs?.tasks !== undefined) {
+    if (n.config.inputs?.tasks !== undefined) {
       anyUnfolded = true
       break
     }
@@ -241,7 +246,7 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
       // cascade (and forward their producers, above). They inherit
       // instability from any unstable member.
       // `computeGroupKey`, with the unkeyed branch kept synchronous.
-      if (node.config.cache === undefined) {
+      if (node.config.inputs === undefined) {
         const key = computeGroupHash(upstream)
         keyById.set(id, key)
         args.groupKeys?.set(id, { key, upstream })
@@ -293,9 +298,8 @@ export async function deriveStableKeys(args: DeriveStableKeysArgs): Promise<Stab
 
     const cacheEnabled = node.config.cache !== undefined
     if (cacheEnabled && !unstable) stableKeys.push({ hash, node })
-    // An uncached key reads its whole project, so `dependsOnSiblingOutputs`
-    // (which answers false for it) is not the gate: any upstream that may
-    // write into this project, or anywhere, leaves the key preliminary.
+    // An uncached key stays preliminary behind any upstream that may write
+    // into this project, or anywhere: none of its writes is declared.
     else if (
       !cacheEnabled &&
       !unstable &&
@@ -332,7 +336,7 @@ export function gatedOutputs(
   }
   if (outputsOf.size === 0) return out
   for (const n of nodes.values()) {
-    const inputs = n.config.cache?.inputs?.files
+    const inputs = n.config.inputs?.files
     const outputs = outputsOf.get(n.projectName)
     if (inputs === undefined || outputs === undefined || isGroupTask(n)) continue
     let back: string[] | undefined
@@ -396,7 +400,7 @@ function readableOutputs(
 const probesAfterWritesOf = new WeakMap<ReadonlyMap<string, TaskNode>, ReadonlySet<string>>()
 
 /**
- * The cached tasks whose `cache.inputs.runtime` / `workspaceRuntime` probes
+ * The cached tasks whose `inputs.runtime` / `workspaceRuntime` probes
  * may read what an upstream writes this run while the key folds nothing of
  * that upstream (X-34). A probe is a shell command and may read anywhere,
  * so no glob bounds it, and its answer taken before the writer ran is the
@@ -424,8 +428,8 @@ export function probesAfterWrites(
   const late = new Set<string>()
   probesAfterWritesOf.set(nodes, late)
   const probes = (n: TaskNode): boolean =>
-    (n.config.cache?.inputs?.runtime?.length ?? 0) > 0 ||
-    (n.config.cache?.inputs?.workspaceRuntime?.length ?? 0) > 0
+    (n.config.inputs?.runtime?.length ?? 0) > 0 ||
+    (n.config.inputs?.workspaceRuntime?.length ?? 0) > 0
   let anyProbe = false
   for (const n of nodes.values()) {
     if (probes(n)) {
@@ -455,7 +459,7 @@ export function probesAfterWrites(
     let writer = false
     let unfolded = false
     // No filter and no order-only edge: the key folds every dependency.
-    const foldsAll = node.orderOnly === undefined && node.config.cache?.inputs?.tasks === undefined
+    const foldsAll = node.orderOnly === undefined && node.config.inputs?.tasks === undefined
     let folds: Set<string> | undefined
     for (const dep of node.deps) {
       if (!nodes.has(dep)) continue
@@ -483,7 +487,7 @@ function foldedBy(
   upstream: TaskOutcome[],
   keyById: Map<string, string>,
 ): (dep: string) => boolean {
-  const filter = node.config.cache?.inputs?.tasks
+  const filter = node.config.inputs?.tasks
   if (isGroupTask(node) || filter === undefined) return (dep) => keyById.has(dep)
   const hashes = new Set(
     filterUpstreamHashes(upstream, filter, node.projectName, node.id).map(([, h]) => h),
@@ -525,7 +529,7 @@ function synthUpstream(
  *     `outputs.files` — direct or transitive — makes the key
  *     preliminary. Project boundaries are hard, so only SAME-project
  *     outputs can reach a project-relative input.
- *   - `cache.inputs.workspaceFiles` is boundary-free: it can read ANY
+ *   - `inputs.workspaceFiles` is boundary-free: it can read ANY
  *     project's dir (so any upstream `outputs.files`, in any project,
  *     matters) or a root-anchored location (so any upstream
  *     `outputs.workspaceFiles` matters). Either → preliminary key. This
@@ -551,9 +555,9 @@ export function dependsOnSiblingOutputs(
   },
 ): boolean {
   const cache = node.config.cache
-  // A cache-disabled task has no key to prefetch anyway; treat as
-  // unstable-irrelevant (caller filters on cacheEnabled).
-  if (cache === undefined) return false
+  const declared = node.config.inputs
+  // A task with no inputs has no key to take up front.
+  if (declared === undefined) return false
   if (upstreamOutputProjects.has(node.projectName)) {
     // A same-project producer whose writes are all declared reaches this
     // task's inputs only where the globs can meet: a `test` reading `src/**`
@@ -562,15 +566,21 @@ export function dependsOnSiblingOutputs(
     // projects (A-20). Undeclared writes, and a rewriter this key does not
     // fold, may land anywhere: those stay project-wide.
     if (sameProject === undefined || sameProject.wide?.has(node.projectName) === true) return true
-    const inputs = cache.inputs?.files
+    const inputs = declared.files
     const outputs = sameProject.outputsOf.get(node.projectName) ?? []
-    if (inputs === undefined || outputs.length === 0) return true
+    if (outputs.length === 0) return true
     // An output the reader's own `!` inputs take back whole is not in its
     // key: `['**/*', '!dist/**']` beside a `dist/**` producer keys the same
-    // before and after it, which is what `run.rules.upfrontKeys` asks a config
-    // to write (X-54).
+    // before and after it, which is what `vx lock` asks a config to write
+    // (X-54).
     // Nor is an output git ignores whole: a key reads only what git lists.
-    const readable = sameProject.readableOf?.get(node.projectName) ?? outputs
+    // Unless an entry starts inside it (`dist/**`): naming an ignored path
+    // makes it an input (`ignoredReach` in cache/inputs.ts).
+    const readable = withNamedIgnored(
+      inputs,
+      outputs,
+      sameProject.readableOf?.get(node.projectName) ?? outputs,
+    )
     const back = inputs.filter((g) => g.startsWith('!')).map((g) => g.slice(1))
     const reach = back.length === 0 ? readable : readable.filter((o) => !outputTakenBack(o, back))
     if (reach.length > 0 && workspaceInputsReach(inputs, reach.map(literalPrefix))) return true
@@ -578,7 +588,7 @@ export function dependsOnSiblingOutputs(
     // that producer, its restore raced the producer's clean and extract
     // (M-5; invariant 2 of docs/design/overlapping-outputs-2026-09.md).
     // `outputsOf` holds this task's own globs too; set them aside once.
-    const own = cache.outputs.files
+    const own = cache?.outputs.files ?? []
     if (own.length > 0) {
       const others = [...outputs]
       for (const g of own) {
@@ -597,7 +607,7 @@ export function dependsOnSiblingOutputs(
   // `app` read `gen/**` project-relative), so the mere presence of a
   // workspace-output producer upstream makes the key preliminary.
   if (hasWsOutputUpstream) return true
-  const wsInputs = cache.inputs?.workspaceFiles ?? []
+  const wsInputs = declared.workspaceFiles ?? []
   if (wsInputs.length > 0 && upstreamOutputProjects.size > 0) {
     // Without the dirs the old answer stands: a workspace reader over any
     // producer is preliminary. With them, only a reader whose globs can
@@ -617,6 +627,29 @@ export function dependsOnSiblingOutputs(
   return false
 }
 
+/**
+ * `readable`, plus each output git ignores whole that a positive entry of
+ * `inputs` starts inside: its literal prefix at or below the output's.
+ */
+function withNamedIgnored(
+  inputs: readonly string[],
+  outputs: readonly string[],
+  readable: readonly string[],
+): readonly string[] {
+  if (readable.length === outputs.length) return readable
+  const named = outputs.filter((o) => {
+    if (readable.includes(o)) return false
+    const at = literalPrefix(o)
+    if (at === '') return false
+    return inputs.some((g) => {
+      if (g.startsWith('!')) return false
+      const p = literalPrefix(g)
+      return p === at || p.startsWith(`${at}/`)
+    })
+  })
+  return named.length === 0 ? readable : [...readable, ...named]
+}
+
 /**
  * Can any positive `workspaceFiles` entry match a path inside one of
  * `dirs` (workspace-relative project dirs)? An entry's reach is its