@vzn/vx 0.0.639 → 0.0.641

package/src/graph/task-graph.ts

@@ -23,6 +23,7 @@ import {
   parseDependencySpec,
   type DependencySpec,
 } from './dependency-spec.js'
+import { foldedDeps, isGroupTask } from './folds.js'
 import type { TaskOutcome } from './scheduler.js'
 
 // Re-exported so existing importers keep working while the type's home
@@ -100,23 +101,9 @@ export function taskId(project: string, task: string): string {
 // graph is where every reader of a task id looks for it.
 export { splitTaskId } from '../util/index.js'
 
-/**
- * A task is a "group" if it has no `exec` — it exists only to chain
- * `dependsOn` (an umbrella for `vx run ci`). Group tasks:
- *   - never spawn a process,
- *   - never read/write the cache (it's a config error to declare one),
- *   - never appear in the run summary or `runs` analytics table,
- *   - render no framed block in the live output.
- * Six call sites used to repeat `node.config.exec === undefined`;
- * centralising the predicate prevents that check from drifting.
- */
-export function isGroupTask(node: TaskNode): boolean {
-  return node.config.exec === undefined
-}
-
-/** A keyed group: the default `build` (orchestrator/projects.ts), or a config's group with `cache`. */
+/** A keyed group: the default `build` (orchestrator/projects.ts), or a config's group with `inputs`. */
 function isKeyedGroup(task: TaskConfig): boolean {
-  return task.exec === undefined && task.cache !== undefined
+  return task.exec === undefined && task.inputs !== undefined
 }
 
 /**
@@ -511,7 +498,7 @@ export function buildTaskGraph(options: BuildGraphOptions): Map<string, TaskNode
 
     // dependsOn is about which tasks to ADD to the graph, not which
     // to filter. BARE wildcards ("*"/"^*" = "everything upstream") and
-    // negation aren't meaningful here — they're cache.inputs.tasks
+    // negation aren't meaningful here — they're inputs.tasks
     // operations. PARTIAL patterns (`build.*`, `^build.*`) are legal:
     // they name a namespace of tasks to add (Nx 19.5 parity).
     if (spec.kind === 'wildcardSelf' || spec.kind === 'wildcardDeps') {
@@ -789,7 +776,7 @@ export function checkGraph(
   // Under a lock an exclusive graph has no overlap to mark; a non-exclusive
   // one still needs the addition marks the walk derives.
   if (!locked || !exclusive) detectOutputCollisions(nodes, workspaceRoot, exclusive)
-  if (rules?.upfrontKeys !== false && !locked) detectInputOverlaps(nodes, workspaceRoot)
+  if (!locked) detectInputOverlaps(nodes, workspaceRoot)
 }
 
 /**
@@ -1497,10 +1484,11 @@ export function outputTakenBack(output: string, negatives: readonly string[]): b
  */
 function refuseSelfClean(node: TaskNode): void {
   const cache = node.config.cache
-  if (cache === undefined) return
+  const declared = node.config.inputs
+  if (cache === undefined || declared === undefined) return
   for (const field of ['files', 'workspaceFiles'] as const) {
-    if (!coversAny(cache.inputs[field], cache.outputs[field])) continue
-    const inputs = splitNegations(cache.inputs[field] ?? [])
+    if (!coversAny(declared[field], cache.outputs[field])) continue
+    const inputs = splitNegations(declared[field] ?? [])
     const out = splitNegations(cache.outputs[field] ?? [])
     const outputs = out.positive
     if (outputs.length === 0) continue
@@ -1519,7 +1507,7 @@ function refuseSelfClean(node: TaskNode): void {
       if (outputTakenBack(gi, out.negative)) continue
       if (!outputTakenBack(gi, near)) continue
       throw new UserError(
-        `${node.id}: every file ${JSON.stringify(gi)} in cache.inputs.${field} selects is also ` +
+        `${node.id}: every file ${JSON.stringify(gi)} in inputs.${field} selects is also ` +
           `its own output — vx removes a task's outputs before it runs, so the task would ` +
           `delete its own sources. A task that rewrites files in place (a formatter) declares ` +
           `no outputs.`,
@@ -1574,13 +1562,14 @@ interface Side {
 }
 
 /**
- * `run.rules.upfrontKeys` (X-54): refuse a task whose input globs can match
- * another task's declared outputs. Such a key reads bytes a producer writes
- * this run, so it is not known until the producer ran (`stable-keys.ts`
- * keeps it waiting); refused, every key reads only what no task writes and
- * can be derived before anything runs (M, 2026-10-07: "hash ahead of time,
- * not waterfall"). A dependency's own key already cascades through
- * `dependsOn`, so the bytes it wrote add nothing a key needs.
+ * Refuse a task whose input globs can match another task's declared
+ * outputs (X-54; no opt-out, owner 2026-10-16). Such a key reads bytes a
+ * producer writes this run, so it is not known until the producer ran;
+ * refused, every key reads only what no task writes and can be derived
+ * before anything runs (M, 2026-10-07: "hash ahead of time, not
+ * waterfall"). A dependency's own key already cascades through
+ * `dependsOn`, so the bytes it wrote add nothing a key needs; the one
+ * exception is `refuseOverlaps`'s unfolded dependency.
  *
  * Proven overlaps only (`outputsOverlap`), as for outputs: a pair the rule
  * cannot decide passes, and the stability gate still keeps it waiting. The
@@ -1612,9 +1601,10 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
   }
   for (const n of nodes.values()) {
     const cache = n.config.cache
-    if (cache === undefined) continue
-    const outFiles = positives(cache.outputs.files)
-    const outWs = positives(cache.outputs.workspaceFiles ?? [])
+    const inputs = n.config.inputs
+    if (inputs === undefined) continue
+    const outFiles = positives(cache?.outputs.files ?? [])
+    const outWs = positives(cache?.outputs.workspaceFiles ?? [])
     if (outFiles.length > 0) {
       const anchor = workspaceRoot === undefined ? undefined : relPosix(workspaceRoot, n.projectDir)
       bucket(n.projectName).push({ node: n, globs: outFiles, reads: false, anchor })
@@ -1626,10 +1616,11 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
       wsWriters.push(side)
     }
     if (isGroupTask(n)) continue
-    const inFiles = positives(cache.inputs.files)
-    const inWs = positives(cache.inputs.workspaceFiles ?? [])
+    const inFiles = positives(inputs.files)
+    const inWs = positives(inputs.workspaceFiles ?? [])
     if (inFiles.length > 0) {
-      bucket(n.projectName).push({ node: n, globs: inFiles, reads: true })
+      const anchor = workspaceRoot === undefined ? undefined : relPosix(workspaceRoot, n.projectDir)
+      bucket(n.projectName).push({ node: n, globs: inFiles, reads: true, anchor })
       filesReaders.push(n)
       projectReaders = true
     }
@@ -1654,7 +1645,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     const sides = [...wsWriters]
     for (const node of filesReaders) {
       const rel = relPosix(workspaceRoot, node.projectDir)
-      const globs = positives(node.config.cache!.inputs.files).map((g) =>
+      const globs = positives(node.config.inputs!.files).map((g) =>
         rel === '' ? g : `${rel}/${g}`,
       )
       sides.push({ node, globs, reads: true, rel })
@@ -1668,7 +1659,7 @@ function detectInputOverlaps(nodes: Map<string, TaskNode>, workspaceRoot?: strin
     }
   }
   if (rootReaders) readsRootedOutputs(memo, found, rooted, filesWriters, workspaceRoot)
-  refuseUnlessIgnored(found, workspaceRoot)
+  refuseOverlaps(found, nodes, workspaceRoot)
 }
 
 function readsRootedOutputs(
@@ -1696,33 +1687,98 @@ function readsRootedOutputs(
   }
 }
 
-/** Each overlapped output, root-relative, and the refusal it meets; the first pair found per output. */
-type Found = Map<string, () => UserError>
+/** One reader of another task's output: the reader's glob's fixed prefix, root-relative. */
+interface Overlap {
+  reader: TaskNode
+  writer: TaskNode
+  prefix: string
+  refuse: () => UserError
+}
+
+/** Each overlapped output, root-relative, and every reader of it. */
+type Found = Map<string, Overlap[]>
 
 /**
- * An output git ignores is no overlap (M, 2026-10-15): a key reads only what
- * git lists, so such an output never reaches it. Asked of git once, for
- * every overlapped output together; an output git cannot speak for (no work
- * tree, a glob no few paths stand for) is refused as before. The answer
- * holds for the lock; a run's stability gate asks git again for itself.
+ * Which overlaps stand. A reader may read the outputs of a task in its
+ * `dependsOn` closure whose key its own does not fold (it sets
+ * `inputs.tasks` and leaves the producer out, also through the tasks it
+ * folds): its key waits for the producer and hashes the bytes (owner,
+ * 2026-10-16). Otherwise an output git ignores whole is no overlap (M,
+ * 2026-10-15), a key reading only what git lists, unless the reader's
+ * glob starts in an ignored path (`dist/**`): naming it is asking for it.
+ * Git is asked once, for every output and prefix together; one it cannot
+ * speak for is refused. The answer holds for the lock; a run's stability
+ * gate asks git again for itself.
  */
-function refuseUnlessIgnored(found: Found, workspaceRoot: string | undefined): void {
+function refuseOverlaps(
+  found: Found,
+  nodes: ReadonlyMap<string, TaskNode>,
+  workspaceRoot: string | undefined,
+): void {
   if (found.size === 0) return
-  if (workspaceRoot !== undefined) {
-    const asks = [...found.keys()].map(ignoreProbes)
-    const paths = asks.flatMap((a) => a?.paths ?? [])
-    const ignored = checkIgnoreSync(workspaceRoot, paths)
-    let listed: string[] | null | undefined
-    const pass = wholeIgnored(found.keys(), ignored, (g) => {
-      listed ??= listedSync(workspaceRoot, [
-        ...new Set(asks.flatMap((a) => (a?.deep === true ? [a.dir] : []))),
-      ])
-      return listed === null || listed.some((f) => taskGlob(g).match(f))
-    })
-    for (const [g, refuse] of found) if (!pass.has(g)) throw refuse()
-    return
+  const reads = dependencyReads(nodes)
+  const left = new Map<string, Overlap[]>()
+  for (const [g, list] of found) {
+    const refused = list.filter((o) => !reads(o.reader, o.writer))
+    if (refused.length > 0) left.set(g, refused)
+  }
+  if (left.size === 0) return
+  if (workspaceRoot === undefined) throw left.values().next().value![0]!.refuse()
+  const asks = [...left.keys()].map(ignoreProbes)
+  const prefixes = new Set<string>()
+  for (const list of left.values()) {
+    for (const o of list) if (o.prefix !== '') prefixes.add(o.prefix).add(`${o.prefix}/`)
+  }
+  const ignored = checkIgnoreSync(workspaceRoot, [
+    ...asks.flatMap((a) => a?.paths ?? []),
+    ...prefixes,
+  ])
+  let listed: string[] | null | undefined
+  const pass = wholeIgnored(left.keys(), ignored, (g) => {
+    listed ??= listedSync(workspaceRoot, [
+      ...new Set(asks.flatMap((a) => (a?.deep === true ? [a.dir] : []))),
+    ])
+    return listed === null || listed.some((f) => taskGlob(g).match(f))
+  })
+  const named = (o: Overlap): boolean =>
+    o.prefix !== '' && ignored !== null && (ignored.has(o.prefix) || ignored.has(`${o.prefix}/`))
+  for (const [g, list] of left) {
+    for (const o of list) if (!pass.has(g) || named(o)) throw o.refuse()
   }
-  throw found.values().next().value!()
+}
+
+/**
+ * Whether a reader may read a writer's outputs: the writer is in the
+ * reader's `dependsOn` closure and not in its folded closure. Each closure
+ * walked once per reader.
+ */
+function dependencyReads(
+  nodes: ReadonlyMap<string, TaskNode>,
+): (reader: TaskNode, writer: TaskNode) => boolean {
+  const nodeOf = (id: string): TaskNode => nodes.get(id)!
+  const deps = new Map<string, Set<string>>()
+  const folded = new Map<string, Set<string>>()
+  const closure = (
+    memo: Map<string, Set<string>>,
+    root: TaskNode,
+    next: (n: TaskNode) => Iterable<TaskNode>,
+  ): Set<string> => {
+    let out = memo.get(root.id)
+    if (out !== undefined) return out
+    out = new Set()
+    const stack = [...next(root)]
+    while (stack.length > 0) {
+      const n = stack.pop()!
+      if (out.has(n.id)) continue
+      out.add(n.id)
+      stack.push(...next(n))
+    }
+    memo.set(root.id, out)
+    return out
+  }
+  return (reader, writer) =>
+    closure(deps, reader, (n) => n.deps.flatMap((d) => nodes.get(d) ?? [])).has(writer.id) &&
+    !closure(folded, reader, (n) => foldedDeps(n, nodeOf).map((c) => c.node)).has(writer.id)
 }
 
 /**
@@ -1745,16 +1801,15 @@ function takenBack(
 ): boolean {
   let tb = memo.bySide.get(reader)
   if (tb === undefined) {
-    const cache = reader.node.config.cache!
+    const inputs = reader.node.config.inputs!
+    const cache = reader.node.config.cache
     // A reader rebased to the root (X-135) speaks in its project's terms.
     const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
     // What the reader's key never reads: its `!` entries and its own outputs.
     const list = [
+      ...splitNegations(field === 'files' ? inputs.files : (inputs.workspaceFiles ?? [])).negative,
       ...splitNegations(
-        field === 'files' ? cache.inputs.files : (cache.inputs.workspaceFiles ?? []),
-      ).negative,
-      ...splitNegations(
-        field === 'files' ? cache.outputs.files : (cache.outputs.workspaceFiles ?? []),
+        field === 'files' ? (cache?.outputs.files ?? []) : (cache?.outputs.workspaceFiles ?? []),
       ).positive,
     ].map((g) => at + g)
     const key = list.join('\0')
@@ -1777,28 +1832,35 @@ function readsOutputs(
   if (x.reads === y.reads || x.node === y.node) return
   const [reader, writer] = x.reads ? [x, y] : [y, x]
   const at = reader.rel === undefined || reader.rel === '' ? '' : `${reader.rel}/`
+  const readerAt = reader.anchor === undefined || reader.anchor === '' ? '' : `${reader.anchor}/`
   for (const go of writer.globs) {
     const rooted =
       writer.anchor === undefined || writer.anchor === '' ? go : `${writer.anchor}/${go}`
-    if (found.has(rooted) || takenBack(memo, reader, field, go)) continue
+    let list = found.get(rooted)
+    if (list?.some((o) => o.reader === reader.node) === true) continue
+    if (takenBack(memo, reader, field, go)) continue
     for (const gi of reader.globs) {
       if (!outputsOverlap(gi, go)) continue
       const shown =
         writer.rel === undefined || writer.rel === '' ? go : go.slice(writer.rel.length + 1)
       const out = at !== '' && go.startsWith(at) ? go.slice(at.length) : go
-      found.set(
-        rooted,
-        () =>
+      const prefix = staticPrefix(readerAt + gi)
+      if (list === undefined) found.set(rooted, (list = []))
+      list.push({
+        reader: reader.node,
+        writer: writer.node,
+        prefix: prefix === '.' ? '' : prefix,
+        refuse: () =>
           new UserError(
-            `${reader.node.id} reads ${JSON.stringify(gi.slice(at.length))} in cache.inputs.${field}, which matches ` +
+            `${reader.node.id} reads ${JSON.stringify(gi.slice(at.length))} in inputs.${field}, which matches ` +
               `${writer.node.id}'s output ${JSON.stringify(shown)} — a task's key must not read ` +
-              `another task's outputs (the dependency's key already cascades through dependsOn). ` +
+              `the outputs of a task it does not depend on, or whose key it already folds. ` +
               `Exclude it: add ${JSON.stringify(`!${out}`)} to ${reader.node.id}'s ` +
-              `cache.inputs.${field}, or set run.rules.upfrontKeys: false in .vx/workspace.ts to ` +
-              `let it wait for its producer.`,
+              `inputs.${field}, or depend on ${writer.node.id} and leave it out of ` +
+              `${reader.node.id}'s inputs.tasks, so its key hashes those bytes instead.`,
             'VX_E_INPUT_IS_OUTPUT',
           ),
-      )
+      })
       break
     }
   }

package/src/handoff.ts

@@ -5,6 +5,11 @@
 // walk runs before anything else loads, through `Bun.file(…).exists()`:
 // importing `node:fs` alone was ~1.1 ms of a 4 ms start (2026-10-13).
 
+/** `vx upgrade -g`: moves only the global vx, so it never hands off (owner, 2026-10-16). */
+export function upgradesOnlyItself(argv: readonly string[]): boolean {
+  return argv[0] === 'upgrade' && argv.some((a) => a === '-g' || a === '--global')
+}
+
 /**
  * The project-local vx to run instead of this one, or null: the workspace
  * root's ({@link workspaceFile}) `node_modules/@vzn/vx`, run through its

package/src/index.ts

@@ -22,7 +22,7 @@ export { machineMemoryBytes, machineParallelism } from './util/index.js'
 // How core reads a task glob — its spelling, and which characters are
 // wildcards (`[` `]` are not; item 667) — for a plugin that turns declared
 // outputs into something else (`@vzn/vx-reapi`'s literal `output_paths`).
-export { isLiteralPattern, normalizeGlob } from './util/index.js'
+export { isLiteralPattern, normalizeGlob, restorableOutput } from './util/index.js'
 
 // Schema types and helpers (used by user vx.config files and presets).
 export type {
@@ -37,7 +37,7 @@ export type {
   ExecConfig,
   ExecEnv,
   CacheConfig,
-  CacheInputs,
+  InputsConfig,
   CacheOutputs,
   InputStability,
   SandboxConfig,

package/src/orchestrator/affected-tasks.ts

@@ -33,7 +33,7 @@ const KEYED_BY_EVERY_TASK: ReadonlySet<string> = new Set(PROJECT_CONFIG_FILENAME
 
 /**
  * The projects every task of which the change reaches: the whole ones the
- * diff named, and those holding a changed path no cached task of theirs
+ * diff named, and those holding a changed path no task of theirs
  * declares as an input. vx cannot prove such a path re-keys nothing (a
  * `project` plugin may read it), so it reaches the whole project, as it did
  * before selection was per task.
@@ -42,15 +42,15 @@ function wholeProjects(
   changes: AffectedChanges,
   projects: ReadonlyMap<string, ProjectEntry>,
 ): Map<string, string | undefined> {
-  // Each whole project, with the path no cached task claims when one did it.
+  // Each whole project, with the path no task claims when one did it.
   const whole = new Map<string, string | undefined>([...changes.whole].map((n) => [n, undefined]))
   for (const [name, rels] of changes.paths) {
     if (whole.has(name)) continue
-    const caches = Object.values(projects.get(name)?.config.tasks ?? {}).flatMap((t) =>
-      t.exec !== undefined && t.cache !== undefined ? [t.cache] : [],
+    const keyed = Object.values(projects.get(name)?.config.tasks ?? {}).filter(
+      (t) => t.exec !== undefined && t.inputs !== undefined,
     )
     const unclaimed = (rel: string): boolean =>
-      KEYED_BY_EVERY_TASK.has(rel) || !caches.some((c) => declaresInput(c, rel, null))
+      KEYED_BY_EVERY_TASK.has(rel) || !keyed.some((t) => declaresInput(t, rel, null))
     const rel = rels.find(unclaimed)
     if (rel !== undefined) whole.set(name, rel)
   }
@@ -60,8 +60,8 @@ function wholeProjects(
 /**
  * Why `--affected` kept a requested task (`vx run --affected --dry`):
  * `input`, a changed `file` is one of its declared inputs; `project`, its
- * project changed and the task reads it whole (an uncached task, a path no
- * cached task declares, or no single `file`: a lockfile claim, a manifest
+ * project changed and the task reads it whole (a task with no inputs, a
+ * path no task declares, or no single `file`: a lockfile claim, a manifest
  * edge, a config import); `workspace`, a workspace-wide `file` (the
  * workspace config, a root file a plugin claims) reached every task of its
  * project; `package`, a `^` edge passes through `project`, a
@@ -86,9 +86,9 @@ export interface AffectedExplain {
 /**
  * The task ids of `ids` whose closure the change reaches, in their order.
  * A group seeds nothing (it runs nothing) unless it is keyed, as the default
- * `build` is; an uncached task seeds when a changed path lies in its project
- * (or the whole project is reached); a cached one when a changed path is one
- * of its declared inputs. A `^name` edge the
+ * `build` is; a task with no inputs seeds when a changed path lies in its
+ * project (or the whole project is reached); one with inputs when a changed
+ * path is one of them. A `^name` edge the
  * graph passes through a package it loaded no config for reaches it as the
  * default `build` would: any change there reaches the task.
  */
@@ -139,14 +139,15 @@ export function affectedRoots(
     return false
   }
   const seeded = (n: TaskNode): boolean => {
-    const cache = n.config.cache
+    const task = n.config
+    const keyed = task.inputs !== undefined
     // Asked of every node, not only the changed projects' (the
     // `workspaceFiles` owners): a `graph` hook may have given the glob.
-    if (cache !== undefined) {
-      const file = changes.changed.find((rel) => declaresInput(cache, null, rel))
+    if (keyed) {
+      const file = changes.changed.find((rel) => declaresInput(task, null, rel))
       const dir =
         file === undefined
-          ? (changes.nested ?? []).find((d) => workspaceFilesReachInto(cache, d))
+          ? (changes.nested ?? []).find((d) => workspaceFilesReachInto(task, d))
           : undefined
       if (file !== undefined || dir !== undefined) {
         seeds?.set(n.id, { kind: 'input', file: (file ?? dir)! })
@@ -155,10 +156,10 @@ export function affectedRoots(
     }
     if (!changes.projects.has(n.projectName)) return false
     const rels = changes.paths.get(n.projectName) ?? []
-    // A group runs nothing; only the default `build` (projects.ts) is keyed.
-    // An uncached task reads its project: a root file another task of it
-    // declares (`workspaceFiles`) is no change there.
-    if (cache === undefined) {
+    // An unkeyed group runs nothing. A task with no inputs may read anything
+    // in its project: a root file another task of it declares
+    // (`workspaceFiles`) is no change there.
+    if (!keyed) {
       const hit = !isGroupTask(n) && (whole.has(n.projectName) || changes.paths.has(n.projectName))
       if (hit) seeds?.set(n.id, inProject(n.projectName, rels[0]))
       return hit
@@ -167,7 +168,7 @@ export function affectedRoots(
       seeds?.set(n.id, inProject(n.projectName, whole.get(n.projectName)))
       return true
     }
-    const rel = rels.find((r) => declaresInput(cache, r, null))
+    const rel = rels.find((r) => declaresInput(task, r, null))
     if (rel === undefined) return false
     if (seeds !== null) seeds.set(n.id, { ...inProject(n.projectName, rel), kind: 'input' })
     return true

package/src/orchestrator/download-policy.ts

@@ -19,7 +19,7 @@ export type DownloadMode = 'eager' | 'deferred' | 'never'
  * The channel this closes is narrow and specific. A dependent's key folds
  * an upstream's KEY, never its output content (pure-input transitive
  * hashing), so deferral cannot move a dependent's key that way. The one
- * real channel is a task whose `cache.inputs` globs can MATCH a producer's
+ * real channel is a task whose `inputs` globs can MATCH a producer's
  * declared outputs on disk: then its key differs by whether the bytes
  * arrived.
  *
@@ -30,7 +30,7 @@ export type DownloadMode = 'eager' | 'deferred' | 'never'
  * `--cache-download=none` with nothing to defer. Comparing the globs' static
  * prefixes answers the question actually being asked, and stays
  * conservative in every direction that matters: a leading wildcard yields
- * `.` and reaches everything, a cacheable task with no declared `files`
+ * `.` and reaches everything, a task with empty `inputs.files`
  * is treated as reading its whole project, and `workspaceFiles` on either
  * side ignores project boundaries — all three force ineligible.
  */
@@ -44,10 +44,10 @@ export function deferralEligibility(nodes: Map<string, TaskNode>): Map<string, s
     if (list) list.push({ taskId: n.id, prefixes, via })
     else readersByProject.set(n.projectName, [{ taskId: n.id, prefixes, via }])
   }
-  // A task with no `cache` block keys on every file in its project, and a
-  // cached task that depends on it folds that key: deferring a producer
-  // there moved both keys with the transfer flag. Only such a task is a
-  // reader — one nothing cached folds keys nothing that lasts.
+  // A task with no `cache` block keys on its inputs, and a cached task that
+  // depends on it folds that key: deferring a producer there moved both
+  // keys with the transfer flag. Only such a task is a reader — one nothing
+  // cached folds keys nothing that lasts.
   const folded = new Set<string>()
   const stack = [...nodes.values()]
     .filter((n) => n.config.cache !== undefined)
@@ -60,14 +60,11 @@ export function deferralEligibility(nodes: Map<string, TaskNode>): Map<string, s
   let workspaceReader: string | undefined
   let runtimeReader: string | undefined
   for (const n of nodes.values()) {
-    const cache = n.config.cache
-    if (cache === undefined) {
-      if (folded.has(n.id) && !isGroupTask(n) && n.config.exec?.persistent === undefined) {
-        addReader(n, ['.'], 'as a task with no cache block that a cached task folds')
-      }
-      continue
-    }
-    if ((cache.inputs?.workspaceFiles?.length ?? 0) > 0) workspaceReader ??= n.id
+    const inputs = n.config.inputs
+    // A task with no inputs has no key to read; an uncached one with inputs
+    // is read only for the cached tasks that fold its key.
+    if (inputs === undefined || (n.config.cache === undefined && !folded.has(n.id))) continue
+    if ((inputs?.workspaceFiles?.length ?? 0) > 0) workspaceReader ??= n.id
     // A `runtime` input is a SHELL COMMAND whose reads are unknowable —
     // the same reason vx refuses to infer inputs by tracing. It can `cat` a
     // producer's output (or path-escape its project to do it), and its
@@ -77,17 +74,14 @@ export function deferralEligibility(nodes: Map<string, TaskNode>): Map<string, s
     // is exactly what such a command would sample. Nothing defers in a run
     // that declares one — worse than nothing would be a key that moves with
     // a transfer flag.
-    if (
-      (cache.inputs?.runtime?.length ?? 0) > 0 ||
-      (cache.inputs?.workspaceRuntime?.length ?? 0) > 0
-    ) {
+    if ((inputs?.runtime?.length ?? 0) > 0 || (inputs?.workspaceRuntime?.length ?? 0) > 0) {
       runtimeReader ??= n.id
     }
-    const files = cache.inputs?.files
+    const files = inputs?.files
     addReader(
       n,
       files === undefined || files.length === 0 ? ['.'] : files.map(staticPrefix),
-      'with cache.inputs.files',
+      'with inputs.files',
     )
   }
 
@@ -105,14 +99,14 @@ export function deferralEligibility(nodes: Map<string, TaskNode>): Map<string, s
     if (runtimeReader !== undefined) {
       ineligible.set(
         n.id,
-        `${runtimeReader} declares a cache.inputs.runtime command, whose reads cannot be bounded`,
+        `${runtimeReader} declares a inputs.runtime command, whose reads cannot be bounded`,
       )
       continue
     }
     if (workspaceReader !== undefined) {
       ineligible.set(
         n.id,
-        `${workspaceReader} declares cache.inputs.workspaceFiles, which can read any project`,
+        `${workspaceReader} declares inputs.workspaceFiles, which can read any project`,
       )
       continue
     }

package/src/orchestrator/excluded-keys.ts

@@ -14,9 +14,9 @@
 // full run looks up.
 
 import type { CacheLayer, GitFilesCache } from '../cache/index.js'
-import { isGroupTask, type TaskNode, type TaskOutcome } from '../graph/index.js'
+import { isGroupTask, keyedDeps, type TaskNode, type TaskOutcome } from '../graph/index.js'
 import { computeGroupKey, computeTaskHash, type HashCache } from './task-hash.js'
-import { filterUpstreamHashes, keyedDeps, keyedOutcome } from './upstream.js'
+import { filterUpstreamHashes, keyedOutcome } from './upstream.js'
 
 export interface KeyExcludedArgs {
   /** The scheduled graph, after `excludeDependencies`. */
@@ -124,7 +124,7 @@ export function excludedTaint(nodes: ReadonlyMap<string, TaskNode>): {
 
 /**
  * Whether `node`'s key folds a dropped dependency's key: a group folds all
- * of its dependencies, an exec task what its `cache.inputs.tasks` selects.
+ * of its dependencies, an exec task what its `inputs.tasks` selects.
  * A task with `tasks: []` folds none, so its entry claims nothing about a
  * dependency and it saves as usual.
  */
@@ -133,7 +133,6 @@ function foldsExcludedKey(node: TaskNode): boolean {
   if (excluded === undefined) return false
   if (isGroupTask(node)) return true
   return (
-    filterUpstreamHashes(excluded, node.config.cache?.inputs?.tasks, node.projectName, node.id)
-      .length > 0
+    filterUpstreamHashes(excluded, node.config.inputs?.tasks, node.projectName, node.id).length > 0
   )
 }