@vzn/vx 0.0.640 → 0.0.642

package/src/cache/inputs.ts

@@ -28,10 +28,12 @@ import {
   isLiteralPattern,
   normalizeGlob,
   outputMatcher,
+  outputNever,
   realpathOf,
   relPosix,
   shellArgv,
   slashBraceExpansions,
+  braceAlternatives,
   splitNegations,
   staticPrefix,
   stripTrailingSlash,
@@ -64,6 +66,11 @@ export {
 // would. (Literal pattern, not the workspace `LOCKFILE_NAME` constant:
 // cache is a leaf module and must not import from workspace.)
 //
+// Relative to the project, so only where vx writes them: its root's `.vx`
+// and the `vx.lock.json` beside its config. Matched at any depth, a
+// project's own `src/.vx/tmp/*` or `src/sub/vx.lock.json` keyed nothing,
+// and an edit to one was a hit (2026-10-17).
+//
 // `node_modules` is not here: the enumeration drops an untracked file
 // under one (`isInstalledPath`), and a tracked one is a source.
 const ALWAYS_IGNORE = [
@@ -78,34 +85,27 @@ const ALWAYS_IGNORE = [
   // member of this list is load-bearing and has a row that fails without
   // it. Kept: the day an enumeration stops going through git, this is
   // what keeps a repository's object store out of a cache key.
-  '**/.git/**',
+  '.git/**',
   // vx's machine-local state; the workspace config beside it is a source.
-  '**/.vx/cache/**',
-  '**/.vx/projects.lock.json',
+  '.vx/cache/**',
+  '.vx/projects.lock.json',
   // `vx lock`'s review copy of a project's resolved config: the config is
   // keyed already, and a re-lock must not move every `**` reader's key.
-  '**/vx.lock.json',
+  'vx.lock.json',
   // What `vx lock` and `vx init` write beside the lock: a re-lock or init
   // must not select every `**` reader under --affected.
-  '**/.vx/.gitattributes',
-  '**/.vx/.gitignore',
-  // `bun build --compile` writes a transient `.<hash>-<n>.bun-build` intermediate
-  // in the cwd. It never rests on disk, so it can't be a real input — but a
-  // broad `inputs.files: ['**/*']` on a compile task would try to hash the temp
-  // file that a CONCURRENT compile is mid-write, racing to EACCES/ENOENT. Always
-  // exclude it (vx is Bun-native; compiling standalone binaries is a common task).
-  '**/*.bun-build',
-  // …and, cross-compiling for a target its cache lacks, the directory it
-  // extracts the downloaded runtime into, `<cwd>/.<16 hex>-<8 hex>.tmp/`,
-  // 60 MB mid-write under the same race (2026-09-29).
-  '**/.????????????????-????????.tmp/**',
-  // vx's own restore temp (archive.ts), live only while an artifact lands
-  // beside its target. A key taken meanwhile listed it, the rename removed
-  // it, and every task reading that directory was withheld its save
-  // (withastro/astro: 25 of 33 builds re-ran on a restore, X-209).
-  '**/.vx-tmp-*',
+  '.vx/.gitattributes',
+  '.vx/.gitignore',
+  // Where restores stage (archive.ts): vx's own, never an input.
+  '.vx/tmp/**',
 ]
 
+/**
+ * `ALWAYS_IGNORE` relative to the workspace root, for `inputs.workspaceFiles`:
+ * those globs cross into other projects, and each one's `vx.lock.json` is vx's.
+ */
+const WORKSPACE_ALWAYS_IGNORE = [...ALWAYS_IGNORE, '**/vx.lock.json']
+
 const DEFAULT_FILE_GLOBS: readonly string[] = ['**/*']
 
 export interface ResolvedInputs {
@@ -169,6 +169,8 @@ export interface ResolveInputsArgs {
   workspaceFilesCache?: WorkspaceFilesCache
   /** Per-run memo for `inputs.files`; see `ProjectFilesCache`. */
   projectFilesCache?: ProjectFilesCache
+  /** Resolve no files: the caller folds them from a `filesToken` memo. */
+  skipFiles?: boolean
 }
 
 export type WorkspaceFilesCache = Map<
@@ -195,23 +197,67 @@ export type ProjectFilesCache = Map<
   { snapshot: readonly string[]; result: readonly string[] }
 >
 
+/**
+ * What a task's input files fold to is a function of this token when it is
+ * one of the git records alone: the project's partition holds only files
+ * the enumeration trusted an index OID for (`GitFilesCache.filesDigest`),
+ * and the declaration reaches no gitignored path and no workspace file.
+ * The token is the digest, the workspace root (the fold folds paths
+ * relative to it) and everything `resolveFiles` keys its memo on.
+ * Undefined when only resolving the files can say.
+ */
+export function filesToken(args: ResolveInputsArgs): string | undefined {
+  if ((args.inputs?.workspaceFiles?.length ?? 0) > 0) return undefined
+  const plan = filesPlan(args.inputs?.files, args.ownOutputs)
+  const cache = args.gitFilesCache
+  if (plan === null || cache === undefined) return undefined
+  const snapshot = cache.snapshotFor(args.projectDir, plan.positiveGlobs)
+  if (snapshot === undefined) return undefined
+  const digest = cache.filesDigest(args.projectDir, snapshot)
+  if (
+    digest === undefined ||
+    ignoredReach(plan, snapshot, { dir: args.projectDir, cache }).length > 0
+  )
+    return undefined
+  return `${args.workspaceRoot}\0${filesMemoKey(args.projectDir, plan, args.ownOutputs, args.ownWorkspaceOutputs ?? [], args.nestedProjectDirs)}\0${digest}`
+}
+
+/** Everything below the git snapshot that decides `resolveFiles`' result. */
+function filesMemoKey(
+  projectDir: string,
+  plan: FilesPlan,
+  ownOutputs: readonly string[],
+  ownWorkspaceOutputs: readonly string[],
+  nestedProjectDirs: readonly string[],
+): string {
+  return `${projectDir}\0${plan.positive.join('\u0001')}\0${plan.negative.join('\u0001')}\0${ownOutputs.join('\u0001')}\0${ownWorkspaceOutputs.join('\u0001')}\0${nestedProjectDirs.join('\u0001')}`
+}
+
 export async function resolveInputs(args: ResolveInputsArgs): Promise<ResolvedInputs> {
-  const projectRel = path.relative(args.workspaceRoot, args.projectDir).split(path.sep).join('/')
-  const { files: projectFiles, listing } = await resolveFiles({
-    projectDir: args.projectDir,
-    workspaceRoot: args.workspaceRoot,
-    files: args.inputs?.files,
-    ownOutputs: args.ownOutputs,
-    ownWorkspaceOutputs: args.ownWorkspaceOutputs ?? [],
-    projectRel,
-    nestedProjectDirs: args.nestedProjectDirs,
-    ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
-    ...(args.projectFilesCache !== undefined ? { projectFilesCache: args.projectFilesCache } : {}),
-  })
+  const projectRel =
+    args.skipFiles === true
+      ? ''
+      : path.relative(args.workspaceRoot, args.projectDir).split(path.sep).join('/')
+  const { files: projectFiles, listing } =
+    args.skipFiles === true
+      ? { files: [], listing: undefined }
+      : await resolveFiles({
+          projectDir: args.projectDir,
+          workspaceRoot: args.workspaceRoot,
+          files: args.inputs?.files,
+          ownOutputs: args.ownOutputs,
+          ownWorkspaceOutputs: args.ownWorkspaceOutputs ?? [],
+          projectRel,
+          nestedProjectDirs: args.nestedProjectDirs,
+          ...(args.gitFilesCache !== undefined ? { gitFilesCache: args.gitFilesCache } : {}),
+          ...(args.projectFilesCache !== undefined
+            ? { projectFilesCache: args.projectFilesCache }
+            : {}),
+        })
   let files = projectFiles
   const listings = listing === undefined ? [] : [listing]
   const wsDecl = args.inputs?.workspaceFiles
-  if (wsDecl !== undefined && wsDecl.length > 0) {
+  if (wsDecl !== undefined && wsDecl.length > 0 && args.skipFiles !== true) {
     const ws = resolveWorkspaceFiles({
       workspaceRoot: args.workspaceRoot,
       workspaceFiles: wsDecl,
@@ -285,7 +331,6 @@ function resolveWorkspaceFiles(args: {
 }): { files: Promise<string[]>; listing: InputListing } | undefined {
   const positive: string[] = []
   const negative: string[] = []
-  refuseOneAlternativeBrace(args.workspaceFiles, 'workspaceFiles')
   for (const entry of args.workspaceFiles) {
     if (entry.startsWith('!')) negative.push(entry.slice(1))
     else positive.push(entry)
@@ -319,7 +364,7 @@ function resolveWorkspaceFiles(args: {
   let isExcluded: ((rel: string) => boolean) | undefined
   let isPositive: ((rel: string) => boolean) | undefined
   const excludedByDeclaration = (rel: string): boolean =>
-    (isExcluded ??= anyTaskGlob([...ALWAYS_IGNORE, ...asTrees(negative)]))(rel)
+    (isExcluded ??= anyTaskGlob([...WORKSPACE_ALWAYS_IGNORE, ...asTrees(negative)]))(rel)
   // A committed file stays an input whatever output reaches it (`committedFiles`).
   let committed: ((abs: string) => boolean) | undefined
   const own = (rel: string): boolean =>
@@ -354,7 +399,10 @@ function resolveWorkspaceFiles(args: {
   const ownsAny =
     splitNegations(args.ownWorkspaceOutputs).positive.length > 0 ||
     splitNegations(args.ownOutputs).positive.length > 0
-  const reach = ignoredReach(reachOf(positive), gitFiles)
+  const reach = ignoredReach(reachOf(positive), gitFiles, {
+    dir: args.workspaceRoot,
+    cache: args.gitFilesCache,
+  })
   const files = base.then((all) => {
     const kept = ownsAny ? all.filter((abs) => !own(relPosix(args.workspaceRoot, abs))) : all
     refuseUndecodable(kept, undecodable, args.workspaceRoot, 'workspaceFiles')
@@ -678,27 +726,13 @@ async function resolveRuntimeValues(
 }
 
 /**
- * What no output glob reaches. An output is otherwise taken as written —
- * `node_modules/**` IS an install task's output, so `ALWAYS_IGNORE` does not
- * apply here — but no task produces these, and a root project declaring
- * `**` would otherwise wipe its repository and the cache it is restoring
- * from (2026-09-16). `.vx` whole and each `vx.lock.json` are vx's own: as
- * outputs, the clean deleted an uncommitted workspace config and a hit
- * restored a lock or ignore file the key does not see over the current one.
- */
-const OUTPUT_NEVER = ['**/.git/**', '**/.vx/**', '**/vx.lock.json']
-
-/**
- * What a set of output globs may not reach: `OUTPUT_NEVER`, and every
- * `node_modules` unless a glob names one. `**\/*.js` meant the build's
- * files, and the clean before each run deleted every installed `.js`
- * under `node_modules` with them (A-13); an install task declares
- * `node_modules/**` and keeps it. Workspace outputs took none of this, not
- * even `.git`.
+ * What a set of output globs may not reach (`outputNever`). `**\/*.js`
+ * meant the build's files, and the clean before each run deleted every
+ * installed `.js` under `node_modules` with them (A-13); an install task
+ * declares `node_modules/**` and keeps it.
  */
-function outputExcludes(outputs: readonly string[]): Bun.Glob[] {
-  const namesNodeModules = outputs.some((o) => normalizeGlob(o).split('/').includes('node_modules'))
-  return (namesNodeModules ? OUTPUT_NEVER : [...OUTPUT_NEVER, '**/node_modules/**']).map(globFor)
+function outputExcludes(outputs: readonly string[], scope: 'project' | 'workspace'): Bun.Glob[] {
+  return outputNever(outputs, scope).map(globFor)
 }
 
 /**
@@ -711,9 +745,31 @@ export async function resolveOutputs(args: {
   outputs: readonly string[]
   nestedProjectDirs: string[]
 }): Promise<string[]> {
+  return (await scanOutputs(args)).files
+}
+
+/**
+ * `resolveOutputs`, plus the empty directories the globs match: a save
+ * keeps them, so a hit leaves the tree a miss left (Turbo and Nx restore
+ * them too). Only a save asks; a hit's walk compares files.
+ */
+export async function resolveOutputTree(args: {
+  projectDir: string
+  outputs: readonly string[]
+  nestedProjectDirs: string[]
+}): Promise<{ files: string[]; emptyDirs: string[] }> {
+  const emptyDirs = new Set<string>()
+  const { files } = await scanOutputs(args, emptyDirs)
+  return { files, emptyDirs: containedIn(args.projectDir, [...emptyDirs]).sort() }
+}
+
+async function scanOutputs(
+  args: { projectDir: string; outputs: readonly string[]; nestedProjectDirs: string[] },
+  emptyDirs?: Set<string>,
+): Promise<{ files: string[] }> {
   const { positive, negative } = splitNegations(args.outputs)
-  if (positive.length === 0) return []
-  const excludeGlobs = [...outputExcludes(positive), ...asTrees(negative).map(globFor)]
+  if (positive.length === 0) return { files: [] }
+  const excludeGlobs = [...outputExcludes(positive, 'project'), ...asTrees(negative).map(globFor)]
   const trees = asTrees(positive)
   refuseDirLinkedOut(args.projectDir, trees)
   const scanned = [
@@ -722,6 +778,7 @@ export async function resolveOutputs(args: {
       excludeGlobs,
       args.projectDir,
       inNestedProject(args.projectDir, args.nestedProjectDirs),
+      emptyDirs,
     )),
   ]
   // Containment, enforced HERE and not only at the loader. `cleanOutputs`
@@ -731,7 +788,7 @@ export async function resolveOutputs(args: {
   // outside the project, so any future caller reaching it by another route (a
   // programmatic embedder, a config source that skips the loader) is contained
   // by construction.
-  return containedIn(args.projectDir, scanned).sort()
+  return { files: containedIn(args.projectDir, scanned).sort() }
 }
 
 /**
@@ -750,8 +807,8 @@ export function committedFiles(
 
 /**
  * The literal head of each output glob, walked: the scan follows a link
- * there (`dist -> ../elsewhere` for `dist/**`) and only there. A link to a
- * FILE is the archive's to judge (L-23); a dangling one the restore's.
+ * there (`dist -> ../elsewhere` for `dist/**`) and only there. A link
+ * below it is an output, kept as the link (`archive.ts`).
  */
 function refuseDirLinkedOut(projectDir: string, trees: readonly string[]): void {
   let realRoot: string | undefined
@@ -763,10 +820,11 @@ function refuseDirLinkedOut(projectDir: string, trees: readonly string[]): void
       if (!isInside(projectDir, at)) break
       let st
       try {
-        st = lstatSync(at)
+        st = lstatSync(at, { throwIfNoEntry: false })
       } catch {
         break
       }
+      if (st === undefined) break
       if (!st.isSymbolicLink()) continue
       let real: string
       try {
@@ -877,6 +935,7 @@ export async function cleanOutputs(args: {
   resolved?: readonly string[] | undefined
 }): Promise<string[]> {
   const committed = args.committed ?? committedFiles(undefined, args.projectDir)
+  sweepRestoreTemps(args.projectDir, args.outputs)
   const matched = args.resolved ?? (await resolveOutputs(args))
   // `force: true` makes rm tolerate ENOENT (e.g. when two output
   // globs overlap and a sibling already deleted a path mid-iteration).
@@ -892,6 +951,70 @@ export async function cleanOutputs(args: {
   return matched.map((f) => relPosix(args.projectDir, f))
 }
 
+/**
+ * Remove the restore temps (`.vx-tmp-<pid>-<n>`, archive.ts) a killed run
+ * left beside an exact-file output. A restore stages in `.vx/tmp/` and
+ * writes one beside its target only where the target is on another
+ * filesystem (EXDEV); a glob over the directory takes it with the outputs,
+ * but `out/a.txt` reaches no sibling, and a partial temp stayed in `out/`
+ * through every later run (Growth's SIGKILL probe, 2026-10-16). A temp
+ * whose writer is alive, this process included, is left: it may be
+ * mid-restore.
+ */
+export function sweepRestoreTemps(base: string, outputs: readonly string[]): void {
+  const dirs = new Set<string>()
+  for (const g of outputs) {
+    if (g.startsWith('!') || !isLiteralPattern(g)) continue
+    dirs.add(path.dirname(path.resolve(base, stripTrailingSlash(normalizeGlob(g)))))
+  }
+  for (const dir of dirs) {
+    let names: string[]
+    try {
+      names = readdirSync(dir)
+    } catch {
+      continue
+    }
+    for (const name of names) {
+      const m = /^\.vx-tmp-([0-9a-z]+)-[0-9a-z]+$/.exec(name)
+      if (m === null) continue
+      const pid = Number.parseInt(m[1]!, 36)
+      if (pid === process.pid || writerAlive(pid)) continue
+      rmSync(path.join(dir, name), { force: true })
+    }
+  }
+}
+
+/**
+ * Empty `.vx/tmp/` (archive.ts `STAGING`) of the staging directories
+ * (`<pid>-<n>`) a killed run left, once per run. One whose writer is alive,
+ * another run's or this one's, is left: it may be mid-restore.
+ */
+export function sweepStaging(workspaceRoot: string): void {
+  const top = path.join(workspaceRoot, '.vx', 'tmp')
+  let names: string[]
+  try {
+    names = readdirSync(top)
+  } catch {
+    return
+  }
+  for (const name of names) {
+    const m = /^([0-9a-z]+)-[0-9a-z]+$/.exec(name)
+    if (m === null) continue
+    const pid = Number.parseInt(m[1]!, 36)
+    if (pid === process.pid || writerAlive(pid)) continue
+    rmSync(path.join(top, name), { recursive: true, force: true })
+  }
+}
+
+function writerAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === 'EPERM'
+  }
+}
+
 /**
  * Remove exactly these project-relative paths — the recorded rows of an
  * ADDITIVE task's own artifact (item 588), never a glob: the glob would
@@ -904,6 +1027,8 @@ export async function cleanOutputPaths(args: {
   rels: readonly string[]
   outputs: readonly string[]
   committed?: (abs: string) => boolean
+  /** Directories the prune leaves standing even when emptied (absolute). */
+  keep?: ReadonlySet<string>
 }): Promise<void> {
   const committed = args.committed ?? committedFiles(undefined, args.projectDir)
   const files = args.rels.map((r) => path.resolve(args.projectDir, r)).filter((f) => !committed(f))
@@ -911,6 +1036,7 @@ export async function cleanOutputPaths(args: {
     args.projectDir,
     await removeAll(files, args.projectDir),
     pruneScope(args.projectDir, args.outputs),
+    args.keep,
   )
 }
 
@@ -1103,6 +1229,7 @@ async function pruneEmptiedDirs(
   root: string,
   removed: readonly string[],
   scope?: PruneScope,
+  keep?: ReadonlySet<string>,
 ): Promise<void> {
   const rootResolved = path.resolve(root)
   // LEVEL ORDER, not a walk-up per directory. A parent is attempted only
@@ -1122,7 +1249,8 @@ async function pruneEmptiedDirs(
       (dir) =>
         dir !== rootResolved &&
         dir.startsWith(rootResolved + path.sep) &&
-        (scope === undefined || inScope(dir, scope)),
+        (scope === undefined || inScope(dir, scope)) &&
+        keep?.has(dir) !== true,
     )
     const gone = (err: NodeJS.ErrnoException): boolean => err.code === 'ENOENT'
     if (dirs.length <= SYNC_CLEAN_MAX) {
@@ -1196,7 +1324,7 @@ export async function resolveWorkspaceOutputs(args: {
 }): Promise<string[]> {
   const { positive, negative } = splitNegations(args.outputs)
   if (positive.length === 0) return []
-  const excludeGlobs = [...outputExcludes(positive), ...asTrees(negative).map(globFor)]
+  const excludeGlobs = [...outputExcludes(positive, 'workspace'), ...asTrees(negative).map(globFor)]
   const scanned = [...(await scanUnion(asTrees(positive), excludeGlobs, args.workspaceRoot))]
   // Same containment as the project twin, anchored one level out. These globs
   // deliberately ignore PROJECT boundaries — that is the escape hatch — but
@@ -1221,6 +1349,7 @@ export async function cleanWorkspaceOutputs(args: {
   resolved?: readonly string[] | undefined
 }): Promise<string[]> {
   const committed = args.committed ?? committedFiles(undefined, args.workspaceRoot)
+  sweepRestoreTemps(args.workspaceRoot, args.outputs)
   const matched = args.resolved ?? (await resolveWorkspaceOutputs(args))
   await pruneEmptiedDirs(
     args.workspaceRoot,
@@ -1256,7 +1385,11 @@ export { asTrees } from '../util/index.js'
  * unanswered. Testing every literal against every file was ~1.5 ms of a
  * 1,800-file all-cached run (2026-10-06).
  */
-function unanswered(literals: readonly string[], files: readonly string[]): Set<string> {
+function unanswered(
+  literals: readonly string[],
+  files: readonly string[],
+  newIgnored?: (lit: string) => boolean,
+): Set<string> {
   const left = new Set<string>()
   for (const lit of literals) {
     const under = `${lit}/`
@@ -1264,7 +1397,7 @@ function unanswered(literals: readonly string[], files: readonly string[]): Set<
       files[lowerBound(files, lit)] === lit ||
       files[lowerBound(files, under)]?.startsWith(under) === true ||
       files.some((rel) => rel === lit || rel.startsWith(under))
-    if (!answered) left.add(lit)
+    if (!answered || newIgnored?.(lit) === true) left.add(lit)
   }
   return left
 }
@@ -1292,19 +1425,33 @@ function lowerBound(files: readonly string[], key: string): number {
 function ignoredReach(
   reach: { prefixes: readonly string[]; literals: readonly string[] },
   listed: readonly string[],
+  ignoredIn?: { dir: string; cache: GitFilesCache | undefined },
 ): readonly string[] {
-  const named = outright(reach)
+  let named = outrightMemo.get(reach)
+  if (named === undefined) outrightMemo.set(reach, (named = outright(reach)))
   if (named.length === 0) return []
   // Per listing and entries: thousands of tasks share a few declarations.
   let memo = reachMemo.get(listed)
   if (memo === undefined) reachMemo.set(listed, (memo = new Map()))
   const key = named.join('\0')
   let left = memo.get(key)
-  if (left === undefined) memo.set(key, (left = [...unanswered(named, listed)]))
+  if (left === undefined) {
+    // A listed path under a named directory git otherwise ignores (a kept
+    // `gen/.gitkeep`) answered for the whole of it, and the untracked files
+    // beside it never entered the key.
+    const cache = ignoredIn?.cache
+    const newIgnored =
+      cache === undefined
+        ? undefined
+        : (lit: string) => cache.newFilesIgnored(path.resolve(ignoredIn!.dir, lit))
+    memo.set(key, (left = [...unanswered(named, listed, newIgnored)]))
+  }
   return left
 }
 
 const reachMemo = new WeakMap<readonly string[], Map<string, readonly string[]>>()
+// A declaration's plan is memoized, so its entries are reckoned once.
+const outrightMemo = new WeakMap<object, string[]>()
 
 /**
  * A declaration's literals and globs' fixed prefixes, each once: none for a
@@ -1324,10 +1471,12 @@ function outright(reach: { prefixes: readonly string[]; literals: readonly strin
 /**
  * The files on disk under the {@link ignoredReach} entries that `accept`
  * keeps, sorted and absolute. A file is hashed from disk like any untracked
- * one; nothing here is stored or restored. An install (`node_modules`)
- * stays out, as in the enumeration: lockfile plugins key it. lstat, not
- * `exists()`: that answers false for a directory. Never memoized: a dependency writes these
- * mid-run.
+ * one; nothing here is stored or restored. `node_modules` is no special
+ * case (owner, 2026-10-16): an ignored path named outright is an input,
+ * a generated client (`node_modules/.prisma/client/**`) too; skipping
+ * installs here folded such an entry to nothing, silently. lstat, not
+ * `exists()`: that answers false for a directory. Never memoized: a
+ * dependency writes these mid-run.
  */
 function ignoredInputs(
   root: string,
@@ -1340,8 +1489,7 @@ function ignoredInputs(
     const st = lstatSync(abs, { throwIfNoEntry: false })
     if (st === undefined) continue
     if (!st.isDirectory()) {
-      if ((st.isFile() || st.isSymbolicLink()) && !isInstalledPath(entry) && accept(entry))
-        found.add(abs)
+      if ((st.isFile() || st.isSymbolicLink()) && accept(entry)) found.add(abs)
       continue
     }
     for (const rel of WALK.scanSync({
@@ -1351,7 +1499,7 @@ function ignoredInputs(
       dot: true,
     })) {
       const full = `${entry}/${rel.split(path.sep).join('/')}`
-      if (isInstalledPath(full) || !accept(full)) continue
+      if (!accept(full)) continue
       const file = path.join(abs, rel)
       if (isInputOnDisk(file)) found.add(file)
     }
@@ -1412,30 +1560,6 @@ function refuseUndecodable(
   )
 }
 
-const ONE_ALTERNATIVE_BRACE = /(?<!\\)\{[^{},]*\}/
-
-/**
- * `Bun.Glob` reads `{b}` as a brace of one alternative, so `src/{b}.ts`
- * matches `src/b.ts` and never a file named `{b}.ts`: that file stays out
- * of the key and an edit to it is a hit. Neither reading is sure to be
- * the one meant, so the entry is refused with both spellings.
- */
-function refuseOneAlternativeBrace(
-  entries: readonly string[],
-  field: 'files' | 'workspaceFiles',
-): void {
-  for (const entry of entries) {
-    const m = ONE_ALTERNATIVE_BRACE.exec(entry)
-    if (m === null) continue
-    const inner = m[0].slice(1, -1)
-    throw new UserError(
-      `inputs.${field}: "${entry}" holds a brace with one alternative, which matches ` +
-        `"${inner}" and never a name holding "${m[0]}". Write "${entry.replace(m[0], inner)}", ` +
-        `or "${entry.replace(m[0], `\\{${inner}\\}`)}" for the braces themselves.`,
-    )
-  }
-}
-
 /** What a `files` declaration and its task's outputs compile to, whatever the project. */
 interface FilesPlan {
   positive: string[]
@@ -1484,7 +1608,6 @@ function filesPlan(
   if (files === undefined) {
     positive.push(...DEFAULT_FILE_GLOBS)
   } else {
-    refuseOneAlternativeBrace(files, 'files')
     for (const entry of files) {
       if (entry.startsWith('!')) negative.push(entry.slice(1))
       else positive.push(entry)
@@ -1591,7 +1714,7 @@ function workspaceMatcher(decl: readonly string[]): (rel: string) => boolean {
   if (m !== undefined) return m
   const { positive, negative } = splitNegations(decl)
   const isPositive = anyTaskGlob(asTrees(positive))
-  const isExcluded = anyTaskGlob([...ALWAYS_IGNORE, ...asTrees(negative)])
+  const isExcluded = anyTaskGlob([...WORKSPACE_ALWAYS_IGNORE, ...asTrees(negative)])
   m = (rel) => isPositive(rel) && !isExcluded(rel)
   workspaceMatchers.set(key, m)
   return m
@@ -1602,7 +1725,7 @@ async function resolveFiles(
 ): Promise<{ files: string[]; listing?: InputListing }> {
   const plan = filesPlan(args.files, args.ownOutputs)
   if (plan === null) return { files: [] }
-  const { positive, negative, isExcluded, ownOutput, positiveGlobs, isPositive } = plan
+  const { isExcluded, ownOutput, positiveGlobs, isPositive } = plan
 
   const nested = inNestedProject(args.projectDir, args.nestedProjectDirs)
   // Its root-anchored outputs that land in the project, as `files` sees them.
@@ -1618,7 +1741,13 @@ async function resolveFiles(
   // duration of one orchestrator run.
   // Everything below the snapshot that decides the result: the project, what
   // it declares, what it excludes as its own outputs, and the boundaries.
-  const memoKey = `${args.projectDir}\0${positive.join('\u0001')}\0${negative.join('\u0001')}\0${args.ownOutputs.join('\u0001')}\0${args.ownWorkspaceOutputs.join('\u0001')}\0${args.nestedProjectDirs.join('\u0001')}`
+  const memoKey = filesMemoKey(
+    args.projectDir,
+    plan,
+    args.ownOutputs,
+    args.ownWorkspaceOutputs,
+    args.nestedProjectDirs,
+  )
   let gitFiles = args.gitFilesCache?.snapshotFor(args.projectDir, positiveGlobs)
   let undecodable = args.gitFilesCache?.undecodableNames
   if (gitFiles !== undefined) {
@@ -1631,7 +1760,7 @@ async function resolveFiles(
         files: withIgnored(
           args.projectDir,
           memo.result,
-          ignoredReach(plan, gitFiles),
+          ignoredReach(plan, gitFiles, { dir: args.projectDir, cache: args.gitFilesCache }),
           plan,
           nested,
           ownWsOutput,
@@ -1693,7 +1822,7 @@ async function resolveFiles(
     if (!input && !committed(abs)) continue
     candidates.push(abs)
   }
-  const reach = ignoredReach(plan, gitFiles)
+  const reach = ignoredReach(plan, gitFiles, { dir: args.projectDir, cache: args.gitFilesCache })
   refuseUndecodable(candidates, undecodable, args.projectDir, 'files')
   // Second pass: existence check — but ONLY for paths without a
   // trusted index OID. A clean-per-status tracked file necessarily
@@ -1824,7 +1953,11 @@ export interface InputListing {
   literals: readonly string[]
 }
 
-function reachOf(positive: readonly string[]): { prefixes: string[]; literals: string[] } {
+function reachOf(entries: readonly string[]): { prefixes: string[]; literals: string[] } {
+  // Each alternative names what it would alone: `{gen/a.txt,gen/b.txt}`
+  // names both files, as `gen/{a,b}.txt` does; whole, it had no fixed
+  // prefix and named nothing (Growth's parity, 2026-10-17).
+  const positive = entries.flatMap(braceAlternatives)
   const prefixes = new Set<string>()
   for (const p of asTrees(positive)) {
     if (isLiteralPattern(p)) continue
@@ -1967,6 +2100,7 @@ async function scanUnion(
   excludeGlobs: readonly Bun.Glob[],
   cwd: string,
   nested: (rel: string) => boolean = () => false,
+  emptyDirs?: Set<string>,
 ): Promise<Set<string>> {
   const matches = new Set<string>()
   // `Bun.Glob`'s scan finds nothing for a brace whose alternatives hold a
@@ -1980,7 +2114,9 @@ async function scanUnion(
       const abs = path.resolve(cwd, rel)
       const st = lstatSync(abs, { throwIfNoEntry: false })
       if (st !== undefined && (st.isFile() || st.isSymbolicLink())) matches.add(abs)
-      else if (st === undefined && rel.includes('\ufffd')) refuseUndecodableOutput(abs)
+      else if (emptyDirs !== undefined && st?.isDirectory() === true) {
+        if (readdirSync(abs).length === 0) emptyDirs.add(abs)
+      } else if (st === undefined && rel.includes('\ufffd')) refuseUndecodableOutput(abs)
     }
   }
   return matches