@vzn/vx 0.0.640 → 0.0.642

package/src/cache/key-fold.ts

@@ -110,7 +110,14 @@ import type { CacheKeyInput } from './layer.js'
 // v43 stays when core stopped folding package files (2026-10-14): the
 // `workspace:` and `pkg:` parts left the chain, so every key moved and no
 // unchanged key holds wrong bytes.
-export const CACHE_VERSION = 'vx-cache-v43'
+// v44: the sidecar lists the empty directories under the outputs; a v43
+// artifact holds none and a hit left them out (Growth's parity, 2026-10-16).
+// v45: the sidecar lists the symlinks under the outputs and a hit makes
+// them; a v44 artifact holds a link as a copy of its target (M, 2026-10-16).
+// v46: vx's names are reserved only at the project root; a v45 artifact
+// left out a build's own `dist/.git/**`, `dist/.vx/**` and nested
+// `vx.lock.json` (Growth's parity, 2026-10-17).
+export const CACHE_VERSION = 'vx-cache-v46'
 
 /**
  * The digest a key folds for an input gone between its enumeration and its
@@ -151,6 +158,87 @@ export async function foldKey(
    */
   behind?: (link: string) => Promise<string>,
 ): Promise<string> {
+  const cap = input.captureInto
+  let h = foldHead(input, digestValue)
+
+  // `resolveFiles` already returns its paths sorted, and a copy-and-sort
+  // of three thousand strings per task is not free: 7.4 ms of a 44-task
+  // run here (2026-09-20). A linear order check costs one comparison per
+  // file instead of n log n, and a caller that hands over an unsorted set
+  // — a plugin's own input list — still gets one. `>` on strings compares
+  // UTF-16 code units, which is what a comparator-less `sort` does.
+  let sortedInputs: readonly string[] = input.inputFiles
+  for (let i = 1; i < sortedInputs.length; i++) {
+    if (sortedInputs[i - 1]! > sortedInputs[i]!) {
+      sortedInputs = [...input.inputFiles].sort()
+      break
+    }
+  }
+  h = xxh3(`inputs:${sortedInputs.length}`, h)
+  // Per-file hash source, in preference order: the caller-supplied
+  // index-OID map (clean tracked files — zero I/O), then hashFile's
+  // stat memo (no read), then a full in-process blob-OID computation.
+  // All three describe the WORKTREE bytes, which is what the task
+  // reads — the index-OID map is only populated for paths whose
+  // worktree form matches their index form, because a clean filter
+  // (`text`/`eol`/`ident`/`filter`/`working-tree-encoding`) makes the index blob a DIFFERENT sequence
+  // of bytes and folding it would let two distinct worktree contents
+  // share a key. The fold order is locked to `sortedInputs` so
+  // results are stable across runs.
+  // The common warm shape is that the caller's OID map covers every file,
+  // and then there is nothing to await: building three thousand promises
+  // per task to resolve values already in hand cost 8.4 ms of that same
+  // run. One pass fills the array, and the first gap falls back to the
+  // awaited form for the whole list.
+  let fileHashes: readonly string[] | undefined
+  const provided = input.fileHashes
+  if (provided !== undefined) {
+    const out: string[] = []
+    for (const file of sortedInputs) {
+      const oid = provided.get(file)
+      if (oid === undefined) break
+      out.push(oid)
+    }
+    if (out.length === sortedInputs.length) fileHashes = out
+  }
+  fileHashes ??= await Promise.all(
+    sortedInputs.map((f) => provided?.get(f) ?? hashFile(f).catch(absentOr)),
+  )
+  // Links are rare, so a list without one awaits nothing more.
+  let behindLinks: Map<number, string> | undefined
+  if (behind !== undefined) {
+    const links: number[] = []
+    for (let i = 0; i < fileHashes.length; i++)
+      if (fileHashes[i]!.startsWith('120000:')) links.push(i)
+    if (links.length > 0) {
+      const digests = await Promise.all(links.map((i) => behind(sortedInputs[i]!)))
+      behindLinks = new Map(links.map((i, n) => [i, digests[n]!]))
+    }
+  }
+  for (let i = 0; i < sortedInputs.length; i++) {
+    const file = sortedInputs[i]!
+    const rel = relOf(file)
+    const oid = fileHashes[i]!
+    const linked = behindLinks?.get(i)
+    // A link folds what it points to in its own step, so a key without one is unchanged.
+    h = xxh3(linked === undefined ? `${rel}\0${oid}` : `${rel}\0${oid}\0${linked}`, h)
+    // The OID is already awaited — file capture is zero extra I/O.
+    if (cap) cap.push({ kind: 'file', name: rel, hash: oid })
+    if (linked !== undefined && cap) cap.push({ kind: 'linked', name: rel, hash: xxh3hex(linked) })
+  }
+
+  return h.toString(16).padStart(16, '0')
+}
+
+/**
+ * The fold up to the input files, which come last: what a task's key is
+ * once its files are folded onto it. `computeTaskHash` asks it alone when
+ * a remembered fold of the same files answers the rest (`FoldMemo`).
+ */
+export function foldHead(
+  input: CacheKeyInput,
+  digestValue: (value: string) => string = xxh3hex,
+): bigint {
   // Seed-chained xxHash3: each step folds one field into the
   // running digest via `xxh3(part, prevDigest)`. Equivalent to the
   // old CryptoHasher.update() pattern, no intermediate buffer.
@@ -230,72 +318,5 @@ export async function foldKey(
       for (const [n, v] of pluginParts) cap.push({ kind: 'plugin', name: n, hash: digestValue(v) })
     }
   }
-
-  // `resolveFiles` already returns its paths sorted, and a copy-and-sort
-  // of three thousand strings per task is not free: 7.4 ms of a 44-task
-  // run here (2026-09-20). A linear order check costs one comparison per
-  // file instead of n log n, and a caller that hands over an unsorted set
-  // — a plugin's own input list — still gets one. `>` on strings compares
-  // UTF-16 code units, which is what a comparator-less `sort` does.
-  let sortedInputs: readonly string[] = input.inputFiles
-  for (let i = 1; i < sortedInputs.length; i++) {
-    if (sortedInputs[i - 1]! > sortedInputs[i]!) {
-      sortedInputs = [...input.inputFiles].sort()
-      break
-    }
-  }
-  h = xxh3(`inputs:${sortedInputs.length}`, h)
-  // Per-file hash source, in preference order: the caller-supplied
-  // index-OID map (clean tracked files — zero I/O), then hashFile's
-  // stat memo (no read), then a full in-process blob-OID computation.
-  // All three describe the WORKTREE bytes, which is what the task
-  // reads — the index-OID map is only populated for paths whose
-  // worktree form matches their index form, because a clean filter
-  // (`text`/`eol`/`ident`/`filter`/`working-tree-encoding`) makes the index blob a DIFFERENT sequence
-  // of bytes and folding it would let two distinct worktree contents
-  // share a key. The fold order is locked to `sortedInputs` so
-  // results are stable across runs.
-  // The common warm shape is that the caller's OID map covers every file,
-  // and then there is nothing to await: building three thousand promises
-  // per task to resolve values already in hand cost 8.4 ms of that same
-  // run. One pass fills the array, and the first gap falls back to the
-  // awaited form for the whole list.
-  let fileHashes: readonly string[] | undefined
-  const provided = input.fileHashes
-  if (provided !== undefined) {
-    const out: string[] = []
-    for (const file of sortedInputs) {
-      const oid = provided.get(file)
-      if (oid === undefined) break
-      out.push(oid)
-    }
-    if (out.length === sortedInputs.length) fileHashes = out
-  }
-  fileHashes ??= await Promise.all(
-    sortedInputs.map((f) => provided?.get(f) ?? hashFile(f).catch(absentOr)),
-  )
-  // Links are rare, so a list without one awaits nothing more.
-  let behindLinks: Map<number, string> | undefined
-  if (behind !== undefined) {
-    const links: number[] = []
-    for (let i = 0; i < fileHashes.length; i++)
-      if (fileHashes[i]!.startsWith('120000:')) links.push(i)
-    if (links.length > 0) {
-      const digests = await Promise.all(links.map((i) => behind(sortedInputs[i]!)))
-      behindLinks = new Map(links.map((i, n) => [i, digests[n]!]))
-    }
-  }
-  for (let i = 0; i < sortedInputs.length; i++) {
-    const file = sortedInputs[i]!
-    const rel = relOf(file)
-    const oid = fileHashes[i]!
-    const linked = behindLinks?.get(i)
-    // A link folds what it points to in its own step, so a key without one is unchanged.
-    h = xxh3(linked === undefined ? `${rel}\0${oid}` : `${rel}\0${oid}\0${linked}`, h)
-    // The OID is already awaited — file capture is zero extra I/O.
-    if (cap) cap.push({ kind: 'file', name: rel, hash: oid })
-    if (linked !== undefined && cap) cap.push({ kind: 'linked', name: rel, hash: xxh3hex(linked) })
-  }
-
-  return h.toString(16).padStart(16, '0')
+  return h
 }

package/src/cache/layer.ts

@@ -677,7 +677,13 @@ export interface CacheLayer {
    * into the workspace root. Callers restoring entries that may carry
    * workspace outputs must pass `workspaceRoot`.
    */
-  restoreOutputs(hash: string, projectDir: string, workspaceRoot?: string): Promise<void>
+  restoreOutputs(
+    hash: string,
+    projectDir: string,
+    workspaceRoot?: string,
+    /** The task's declared outputs: an entry outside them fails the restore, nothing written. */
+    outputs?: DeclaredOutputs,
+  ): Promise<void>
   save(args: {
     hash: string
     /**
@@ -692,6 +698,8 @@ export interface CacheLayer {
     entry: Omit<CacheEntry, 'hash' | 'storedAt' | 'outputFiles' | 'exitCode'>
     projectDir: string
     outputFiles: string[]
+    /** The empty directories under the outputs (absolute), kept so a hit makes them. */
+    outputDirs?: string[]
     /**
      * Resolved `outputs.workspaceFiles` (absolute paths) + the root
      * they're relative to. Packed under `workspace-outputs/<rel>`.
@@ -708,12 +716,6 @@ export interface CacheLayer {
      * Only computed on the miss/save path — never on a hit.
      */
     inputComponents?: readonly TaskInputRow[]
-    /**
-     * For a sandboxed task: whether it could read a canonical path. A
-     * symlinked output is packed as its target's bytes, outside the
-     * sandbox, so one whose target the task could not read is refused.
-     */
-    readable?: ((real: string) => boolean) | undefined
   }): Promise<void>
   /**
    * Adopt an artifact produced elsewhere — the remote-hit path. Streams

package/src/cache/layered-cache.ts

@@ -21,6 +21,7 @@ import type { Cache } from './cache.js'
 import type {
   CacheEntry,
   CacheGetContext,
+  DeclaredOutputs,
   CacheKeyInput,
   CacheLayer,
   CacheStats,
@@ -35,6 +36,44 @@ import type {
 } from './cache.js'
 import type { OutputDirRow } from './cache.js'
 import { RemoteLane, type ResolvedRemote } from './remote-lane.js'
+import type { PluginSecrets } from '../util/index.js'
+
+const STOPPED: unique symbol = Symbol('stopped')
+
+/**
+ * A response body that errors once the run stops, so the ingest reading it
+ * fails at once, removes its temp, and releases the connection; the cache
+ * then closes under no write.
+ */
+function endsOnStop(body: Blob | Response, stopped: Promise<typeof STOPPED>): Blob | Response {
+  if (body instanceof Blob || body.body === null) return body
+  const reader = body.body.getReader()
+  let stop = false
+  // Once, not raced per chunk: a cancel ends the pending read as `done`,
+  // which the flag turns into an error rather than a short body.
+  void stopped.then(() => {
+    stop = true
+    void reader.cancel().catch(() => undefined)
+  })
+  const stream = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      const next = await reader.read()
+      if (stop) controller.error(new Error('the run was stopped'))
+      else if (next.done) controller.close()
+      else controller.enqueue(next.value)
+    },
+    cancel: (reason) => reader.cancel(reason),
+  })
+  return new Response(stream, { headers: body.headers })
+}
+
+/** What a remote's `open` is handed: the run's CI verdict and its plugin's keychain. */
+export interface RemoteOpenContext extends PluginSecrets {
+  /** The run is on CI: nobody may be asked. */
+  readonly ci: boolean
+  /** One line naming the plugin, for a fact that leaves the remote on. */
+  warn(message: string): void
+}
 
 /**
  * What a remote cache layer must provide — THE plugin seam for remote
@@ -62,10 +101,16 @@ export interface RemoteCacheLayer {
    */
   readonly endpoint?: string
   /**
-   * What the wire's credential allows, when less than both (a read-only
-   * token): core clears the run's remote axis it lacks. Omitted → both.
+   * Optional: make the layer ready (read a credential, ask for one).
+   * Called once per run, in declared order, before the status line and the
+   * first task, and only when the run's policy lets this remote read or
+   * write: a `--cache-policy=remote:` run, `--no-cache` and a plan
+   * (`--dry`, `vx show`) never call it, so the other methods may be asked
+   * without it. A throw is a warning naming the plugin and turns the
+   * remote off for the run; the run goes on. `ctx.secret` reads the
+   * plugin's keychain and may ask on the terminal.
    */
-  readonly access?: { readonly read?: boolean; readonly write?: boolean }
+  open?(ctx: RemoteOpenContext): Promise<void>
   /** Existence probe: `--dry` and `--force` ask it per key when the remote cannot batch. */
   has(hash: string): Promise<boolean>
   /**
@@ -103,7 +148,6 @@ export class LayeredCache implements CacheLayer {
   readonly hasRemote = true
 
   private readonly lanes: readonly RemoteLane[]
-  private readonly readable: readonly RemoteLane[]
 
   /**
    * In-flight remote pulls keyed by hash. `prefetch` and `get` both go
@@ -134,7 +178,11 @@ export class LayeredCache implements CacheLayer {
     remotes: readonly ResolvedRemote[],
   ) {
     this.lanes = remotes.map((r) => new RemoteLane(r, local.traffic))
-    this.readable = this.lanes.filter((l) => l.read)
+  }
+
+  // Asked, not kept: a remote whose `open` failed leaves the run after this is built.
+  private get readable(): RemoteLane[] {
+    return this.lanes.filter((l) => l.read)
   }
 
   key(input: CacheKeyInput): Promise<string> {
@@ -284,7 +332,17 @@ export class LayeredCache implements CacheLayer {
 
   private async pullFrom(lane: RemoteLane, hash: string, ctx?: CacheGetContext): Promise<boolean> {
     const fetchStart = performance.now()
-    const remoteBody = await lane.get(hash)
+    // A stopped run waits on no read, as on no upload: a lookup or download
+    // in flight held a Ctrl-C until its last byte (M, 2026-10-17). The
+    // plugin's request is left to the exit, and its body is cancelled.
+    const stopped = lane.whenStopped.then((): typeof STOPPED => STOPPED)
+    const pending = lane.get(hash)
+    const remoteBody = await Promise.race([pending, stopped])
+    if (remoteBody === STOPPED) {
+      // A late answer's body would hold its connection to the exit.
+      void pending.then((r) => (r?.body instanceof Response ? r.body.body?.cancel() : undefined))
+      return false
+    }
     if (remoteBody === null) return false
 
     // Ingest the remote body into local using the caller-supplied
@@ -305,7 +363,9 @@ export class LayeredCache implements CacheLayer {
       ...(ctx?.outputs !== undefined ? { outputs: ctx.outputs } : {}),
     }
     try {
-      await this.local.ingest(hash, remoteBody.body, meta)
+      const ingest = this.local.ingest(hash, endsOnStop(remoteBody.body, stopped), meta)
+      ingest.catch(() => undefined)
+      if ((await Promise.race([ingest, stopped])) === STOPPED) return false
     } catch (err) {
       // The bytes came off the network — a corrupt/truncated remote
       // artifact must degrade to a cache miss (task re-executes), not
@@ -330,8 +390,13 @@ export class LayeredCache implements CacheLayer {
     return this.local.hashFile(filePath)
   }
 
-  async restoreOutputs(hash: string, projectDir: string, workspaceRoot?: string): Promise<void> {
-    await this.local.restoreOutputs(hash, projectDir, workspaceRoot)
+  async restoreOutputs(
+    hash: string,
+    projectDir: string,
+    workspaceRoot?: string,
+    outputs?: DeclaredOutputs,
+  ): Promise<void> {
+    await this.local.restoreOutputs(hash, projectDir, workspaceRoot, outputs)
   }
 
   async save(args: SaveArgs): Promise<void> {

package/src/cache/output-index.ts

@@ -17,7 +17,8 @@ const FILE_PREFIX_MTIME = -2
 
 import type { Database } from 'bun:sqlite'
 import { inHashes, lazyStatement } from './schema.js'
-import { lstatSync, statSync } from 'node:fs'
+import { modeMatches } from './umask.js'
+import { lstatSync, readlinkSync, statSync } from 'node:fs'
 import { lstat, readdir } from 'node:fs/promises'
 import path from 'node:path'
 import {
@@ -30,6 +31,19 @@ import {
   WORKSPACE_OUTPUT_PREFIX,
 } from './layer.js'
 
+/**
+ * The mode a symlink output's row carries (S_IFLNK): its size is the
+ * target's byte length and its mtime the target's CRC-32.
+ */
+export const LINK_MODE = 0o120000
+
+/** A link row is current while a link with that target stands there; never followed. */
+function linkCurrent(abs: string, e: { size: number; mtimeMs: number }): boolean {
+  if (!lstatSync(abs).isSymbolicLink()) return false
+  const to = readlinkSync(abs, 'buffer')
+  return to.byteLength === e.size && Bun.hash.crc32(to) === e.mtimeMs
+}
+
 export class OutputIndex {
   private readonly insertOutputFile: ReturnType<Database['prepare']>
   private readonly deleteOutputFiles: ReturnType<Database['prepare']>
@@ -206,10 +220,13 @@ export class OutputIndex {
     // graph stage 100 → 54 ms, the whole process 422 → 368 ms.
     const results = expected.map((e) => {
       try {
+        if (e.mode === LINK_MODE) return linkCurrent(path.join(projectDir, e.path), e)
         const s = statSync(path.join(projectDir, e.path))
+        // An empty output directory: current while a directory stands there.
+        if (e.path.endsWith('/')) return s.isDirectory()
         return (
           s.size === e.size &&
-          (s.mode & 0o777) === (e.mode & 0o777) &&
+          modeMatches(s.mode, e.mode) &&
           // MILLISECOND comparison (sub-ms tolerance for the float
           // round-trip through utimes). Save rows carry stat-ms and
           // restoreOutputs re-syncs restored files to the row value,
@@ -324,6 +341,7 @@ export class OutputIndex {
     const rows = this.rowsOf(hash)
     const stamps: Array<[string, number, number]> = []
     for (const e of rows) {
+      if (e.path.endsWith('/') || e.mode === LINK_MODE) continue
       const ws = e.path.startsWith(WORKSPACE_OUTPUT_PREFIX)
       const abs = ws
         ? path.join(workspaceRoot, e.path.slice(WORKSPACE_OUTPUT_PREFIX.length))
@@ -332,7 +350,7 @@ export class OutputIndex {
         const s = statSync(abs)
         if (
           s.size === e.size &&
-          (s.mode & 0o777) === (e.mode & 0o777) &&
+          modeMatches(s.mode, e.mode) &&
           Math.abs(s.mtimeMs - e.mtimeMs) < 1
         ) {
           stamps.push([e.path, s.ino, Math.floor(s.ctimeMs)])
@@ -415,10 +433,13 @@ export class OutputIndex {
     const results = rows.map((r) => {
       let st
       try {
-        st = lstatSync(path.join(projectDir, r.path))
+        // No throw for a missing dir: every restore after a clean asks
+        // about one, and an exception per hit cost more than the stat.
+        st = lstatSync(path.join(projectDir, r.path), { throwIfNoEntry: false })
       } catch {
         return r.mtimeMs === ABSENT_DIR_MTIME
       }
+      if (st === undefined) return r.mtimeMs === ABSENT_DIR_MTIME
       if (r.mtimeMs === ABSENT_DIR_MTIME) return false
       if (r.mtimeMs === FILE_PREFIX_MTIME) return st.isFile()
       return st.isDirectory() && Math.abs(st.mtimeMs - r.mtimeMs) < 1

package/src/cache/remote-lane.ts

@@ -10,8 +10,11 @@ import type { RemoteCacheLayer } from './layered-cache.js'
 /** One remote, resolved: its wire and what the run's policy and its `access` let it do. */
 export interface ResolvedRemote {
   readonly remote: RemoteCacheLayer
-  readonly read: boolean
-  readonly write: boolean
+  /** The plugin that supplied it, whose keychain its `open` reads; none for an injected layer. */
+  readonly plugin?: string
+  /** Cleared, with `write`, when the remote's `open` fails: off for the rest of the run. */
+  read: boolean
+  write: boolean
   /** Told of each failure this remote degrades to a miss; the default writes stderr. */
   readonly onError?: (err: Error) => void
 }
@@ -89,8 +92,7 @@ function batchOf(hashes: readonly string[]): { batch: string } {
 }
 
 export class RemoteLane {
-  readonly read: boolean
-  readonly write: boolean
+  private readonly resolved: ResolvedRemote
   private readonly remote: RemoteCacheLayer
   private readonly endpoint: string | undefined
   private readonly onError: ((err: Error) => void) | undefined
@@ -132,13 +134,20 @@ export class RemoteLane {
     resolved: ResolvedRemote,
     private readonly traffic: RemoteTraffic,
   ) {
+    this.resolved = resolved
     this.remote = resolved.remote
-    this.read = resolved.read
-    this.write = resolved.write
     this.onError = resolved.onError
     this.endpoint = printableEndpoint(resolved.remote.endpoint)
   }
 
+  get read(): boolean {
+    return this.resolved.read
+  }
+
+  get write(): boolean {
+    return this.resolved.write
+  }
+
   /**
    * Existence probe; a failure is a miss. A key a `hasMany` this run
    * answered for is not asked again: `--dry` batches its keys first.
@@ -248,6 +257,7 @@ export class RemoteLane {
     tally: { count: number; bytes: number; ms: number; failed: number },
   ): void {
     const key = this.trafficOf(hash)
+    const counted = this.traffic.aliases.get(hash) ?? hash
     key.uploading++
     this.traffic.inFlight++
     this.uploadQueue.push(async () => {
@@ -274,12 +284,17 @@ export class RemoteLane {
         // Nothing sent and nothing failed (the remote held it, or the run
         // stopped first): no traffic, so the footer counts no upload.
         if (key.uploading === 0 && !key.landed && key.failures.length === 0)
-          this.traffic.keys.delete(hash)
+          this.traffic.keys.delete(counted)
       }
     })
     this.pump()
   }
 
+  /** Settles when the run is stopped. */
+  get whenStopped(): Promise<void> {
+    return this.stopping
+  }
+
   /** Resolves once every queued and in-flight upload has settled, or the run was stopped. */
   async drain(): Promise<void> {
     // A probe no upload waited on still runs: settled before the run tears
@@ -292,7 +307,8 @@ export class RemoteLane {
   /**
    * The run was stopped (Ctrl-C, SIGTERM, an embedder's abort): queued
    * uploads never start and the drain stops waiting on the ones in flight,
-   * which a plugin cannot be asked to cancel. A slow remote held a stopped
+   * which a plugin cannot be asked to cancel. Reads in flight are given up
+   * the same way (`LayeredCache.pullFrom`). A slow remote held a stopped
    * run past the signal's exit bound, which then exited with no footer.
    */
   stop(): void {
@@ -343,10 +359,11 @@ export class RemoteLane {
   }
 
   private trafficOf(hash: string): RemoteKeyTraffic {
-    let key = this.traffic.keys.get(hash)
+    const counted = this.traffic.aliases.get(hash) ?? hash
+    let key = this.traffic.keys.get(counted)
     if (key === undefined) {
       key = { uploading: 0, landed: false, failures: [] }
-      this.traffic.keys.set(hash, key)
+      this.traffic.keys.set(counted, key)
     }
     return key
   }

package/src/cache/schema.ts

@@ -140,6 +140,14 @@ export function createTables(db: Database, store: 'main' | 'store' = 'main'): vo
       content_hash TEXT NOT NULL,
       seen_at      INTEGER NOT NULL
     );
+    -- v42: each task's last key by its fold up to the files and a token of
+    -- the files' git records (fold-memo.ts). A memo: the KEY is unchanged.
+    CREATE TABLE IF NOT EXISTS main.fold_memo (
+      task_id TEXT PRIMARY KEY,
+      probe   TEXT NOT NULL,
+      key     TEXT NOT NULL,
+      seen_at INTEGER NOT NULL
+    );
     -- The size of each index blob the enumeration checked against the
     -- worktree size git recorded (A-60). Fixed for its OID, so a warm
     -- run asks git for none; swept with file_hashes by seen_at, the
@@ -317,8 +325,10 @@ export function createTables(db: Database, store: 'main' | 'store' = 'main'): vo
  * the artifact is the record and the entries only its inventory, so a reset
  * drops the rows and keeps these, as it keeps the files. `artifacts_meta`
  * holds the table's own layout version (`'layout'`), the one thing that may
- * drop it. `at` is the last use a row-less sweep judges, as a file's mtime;
- * it sits before `bytes` so reading it never walks a blob's overflow pages.
+ * drop it. `at` is the last use a row-less sweep judges, as a file's mtime.
+ * A rowid table, not WITHOUT ROWID: there the blob sits in the key's b-tree,
+ * so every probe of a hash reads overflow pages; 10 000 lookups took 312 ms
+ * against 8.5 (a2, 2026-10-17).
  */
 export function createArtifactTables(db: Database, store: 'main' | 'store'): void {
   db.exec(artifactTables(store))
@@ -331,7 +341,7 @@ function artifactTables(store: 'main' | 'store'): string {
       hash  TEXT PRIMARY KEY,
       at    INTEGER NOT NULL,
       bytes BLOB NOT NULL
-    ) WITHOUT ROWID;
+    );
     CREATE TABLE IF NOT EXISTS ${store}.artifacts_meta (
       key   TEXT PRIMARY KEY,
       value TEXT NOT NULL

package/src/cache/scoped-cache.ts

@@ -8,6 +8,7 @@ import type {
   CacheEntry,
   CacheGetContext,
   CacheLayer,
+  DeclaredOutputs,
   IngestMeta,
   InvocationRecord,
   OutputDirRow,
@@ -60,7 +61,9 @@ export class ScopedCache implements CacheLayer {
   }
 
   private own(hash: string): string {
-    return scopedKey(this.scope, hash)
+    const key = scopedKey(this.scope, hash)
+    this.local?.traffic.aliases.set(key, hash)
+    return key
   }
 
   private keyOf(hash: string): string {
@@ -194,8 +197,13 @@ export class ScopedCache implements CacheLayer {
     return (await this.inner.outputDirsCurrent?.(projectDir, rows)) ?? false
   }
 
-  restoreOutputs(hash: string, projectDir: string, workspaceRoot?: string): Promise<void> {
-    return this.inner.restoreOutputs(this.keyOf(hash), projectDir, workspaceRoot)
+  restoreOutputs(
+    hash: string,
+    projectDir: string,
+    workspaceRoot?: string,
+    outputs?: DeclaredOutputs,
+  ): Promise<void> {
+    return this.inner.restoreOutputs(this.keyOf(hash), projectDir, workspaceRoot, outputs)
   }
 
   save(args: SaveArgs): Promise<void> {

package/src/cache/umask.ts

@@ -0,0 +1,29 @@
+// The process umask, read when a restore starts: Bun reads it by setting 0
+// and putting it back in one synchronous call (project-loader.ts
+// `currentUmask`), so no spawn on this thread sees the 0, and a run
+// evaluates no config in a worker. Through globalThis: the playground's
+// shim has no umask.
+const proc = globalThis.process as { umask?: () => number } | undefined
+let umask = 0
+
+/** Read the umask again: a restore's modes follow the process's as it is now. */
+export function readUmask(): void {
+  if (typeof proc?.umask === 'function') umask = proc.umask()
+}
+readUmask()
+
+/**
+ * The permission bits a restore gives a stored `mode`: minus the umask, as
+ * tar gives a non-root user and Turbo does. A hit under `umask 077` gave
+ * back 0644 / 0755 where the build left 0600 / 0700, readable by every
+ * user on the machine (Growth's parity run, 2026-10-16).
+ */
+export function restoredMode(mode: number): number {
+  return mode & 0o777 & ~umask
+}
+
+/** A file on disk holds the stored `mode`: as saved, or as a restore here leaves it. */
+export function modeMatches(disk: number, stored: number): boolean {
+  const d = disk & 0o777
+  return d === (stored & 0o777) || d === restoredMode(stored)
+}