@vzn/vx 0.0.641 → 0.0.642

package/src/cache/layer.ts

@@ -698,6 +698,8 @@ export interface CacheLayer {
     entry: Omit<CacheEntry, 'hash' | 'storedAt' | 'outputFiles' | 'exitCode'>
     projectDir: string
     outputFiles: string[]
+    /** The empty directories under the outputs (absolute), kept so a hit makes them. */
+    outputDirs?: string[]
     /**
      * Resolved `outputs.workspaceFiles` (absolute paths) + the root
      * they're relative to. Packed under `workspace-outputs/<rel>`.
@@ -714,12 +716,6 @@ export interface CacheLayer {
      * Only computed on the miss/save path — never on a hit.
      */
     inputComponents?: readonly TaskInputRow[]
-    /**
-     * For a sandboxed task: whether it could read a canonical path. A
-     * symlinked output is packed as its target's bytes, outside the
-     * sandbox, so one whose target the task could not read is refused.
-     */
-    readable?: ((real: string) => boolean) | undefined
   }): Promise<void>
   /**
    * Adopt an artifact produced elsewhere — the remote-hit path. Streams

package/src/cache/layered-cache.ts

@@ -36,6 +36,44 @@ import type {
 } from './cache.js'
 import type { OutputDirRow } from './cache.js'
 import { RemoteLane, type ResolvedRemote } from './remote-lane.js'
+import type { PluginSecrets } from '../util/index.js'
+
+const STOPPED: unique symbol = Symbol('stopped')
+
+/**
+ * A response body that errors once the run stops, so the ingest reading it
+ * fails at once, removes its temp, and releases the connection; the cache
+ * then closes under no write.
+ */
+function endsOnStop(body: Blob | Response, stopped: Promise<typeof STOPPED>): Blob | Response {
+  if (body instanceof Blob || body.body === null) return body
+  const reader = body.body.getReader()
+  let stop = false
+  // Once, not raced per chunk: a cancel ends the pending read as `done`,
+  // which the flag turns into an error rather than a short body.
+  void stopped.then(() => {
+    stop = true
+    void reader.cancel().catch(() => undefined)
+  })
+  const stream = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      const next = await reader.read()
+      if (stop) controller.error(new Error('the run was stopped'))
+      else if (next.done) controller.close()
+      else controller.enqueue(next.value)
+    },
+    cancel: (reason) => reader.cancel(reason),
+  })
+  return new Response(stream, { headers: body.headers })
+}
+
+/** What a remote's `open` is handed: the run's CI verdict and its plugin's keychain. */
+export interface RemoteOpenContext extends PluginSecrets {
+  /** The run is on CI: nobody may be asked. */
+  readonly ci: boolean
+  /** One line naming the plugin, for a fact that leaves the remote on. */
+  warn(message: string): void
+}
 
 /**
  * What a remote cache layer must provide — THE plugin seam for remote
@@ -62,6 +100,17 @@ export interface RemoteCacheLayer {
    * dropped before it is printed.
    */
   readonly endpoint?: string
+  /**
+   * Optional: make the layer ready (read a credential, ask for one).
+   * Called once per run, in declared order, before the status line and the
+   * first task, and only when the run's policy lets this remote read or
+   * write: a `--cache-policy=remote:` run, `--no-cache` and a plan
+   * (`--dry`, `vx show`) never call it, so the other methods may be asked
+   * without it. A throw is a warning naming the plugin and turns the
+   * remote off for the run; the run goes on. `ctx.secret` reads the
+   * plugin's keychain and may ask on the terminal.
+   */
+  open?(ctx: RemoteOpenContext): Promise<void>
   /** Existence probe: `--dry` and `--force` ask it per key when the remote cannot batch. */
   has(hash: string): Promise<boolean>
   /**
@@ -99,7 +148,6 @@ export class LayeredCache implements CacheLayer {
   readonly hasRemote = true
 
   private readonly lanes: readonly RemoteLane[]
-  private readonly readable: readonly RemoteLane[]
 
   /**
    * In-flight remote pulls keyed by hash. `prefetch` and `get` both go
@@ -130,7 +178,11 @@ export class LayeredCache implements CacheLayer {
     remotes: readonly ResolvedRemote[],
   ) {
     this.lanes = remotes.map((r) => new RemoteLane(r, local.traffic))
-    this.readable = this.lanes.filter((l) => l.read)
+  }
+
+  // Asked, not kept: a remote whose `open` failed leaves the run after this is built.
+  private get readable(): RemoteLane[] {
+    return this.lanes.filter((l) => l.read)
   }
 
   key(input: CacheKeyInput): Promise<string> {
@@ -280,7 +332,17 @@ export class LayeredCache implements CacheLayer {
 
   private async pullFrom(lane: RemoteLane, hash: string, ctx?: CacheGetContext): Promise<boolean> {
     const fetchStart = performance.now()
-    const remoteBody = await lane.get(hash)
+    // A stopped run waits on no read, as on no upload: a lookup or download
+    // in flight held a Ctrl-C until its last byte (M, 2026-10-17). The
+    // plugin's request is left to the exit, and its body is cancelled.
+    const stopped = lane.whenStopped.then((): typeof STOPPED => STOPPED)
+    const pending = lane.get(hash)
+    const remoteBody = await Promise.race([pending, stopped])
+    if (remoteBody === STOPPED) {
+      // A late answer's body would hold its connection to the exit.
+      void pending.then((r) => (r?.body instanceof Response ? r.body.body?.cancel() : undefined))
+      return false
+    }
     if (remoteBody === null) return false
 
     // Ingest the remote body into local using the caller-supplied
@@ -301,7 +363,9 @@ export class LayeredCache implements CacheLayer {
       ...(ctx?.outputs !== undefined ? { outputs: ctx.outputs } : {}),
     }
     try {
-      await this.local.ingest(hash, remoteBody.body, meta)
+      const ingest = this.local.ingest(hash, endsOnStop(remoteBody.body, stopped), meta)
+      ingest.catch(() => undefined)
+      if ((await Promise.race([ingest, stopped])) === STOPPED) return false
     } catch (err) {
       // The bytes came off the network — a corrupt/truncated remote
       // artifact must degrade to a cache miss (task re-executes), not

package/src/cache/output-index.ts

@@ -17,7 +17,8 @@ const FILE_PREFIX_MTIME = -2
 
 import type { Database } from 'bun:sqlite'
 import { inHashes, lazyStatement } from './schema.js'
-import { lstatSync, statSync } from 'node:fs'
+import { modeMatches } from './umask.js'
+import { lstatSync, readlinkSync, statSync } from 'node:fs'
 import { lstat, readdir } from 'node:fs/promises'
 import path from 'node:path'
 import {
@@ -30,6 +31,19 @@ import {
   WORKSPACE_OUTPUT_PREFIX,
 } from './layer.js'
 
+/**
+ * The mode a symlink output's row carries (S_IFLNK): its size is the
+ * target's byte length and its mtime the target's CRC-32.
+ */
+export const LINK_MODE = 0o120000
+
+/** A link row is current while a link with that target stands there; never followed. */
+function linkCurrent(abs: string, e: { size: number; mtimeMs: number }): boolean {
+  if (!lstatSync(abs).isSymbolicLink()) return false
+  const to = readlinkSync(abs, 'buffer')
+  return to.byteLength === e.size && Bun.hash.crc32(to) === e.mtimeMs
+}
+
 export class OutputIndex {
   private readonly insertOutputFile: ReturnType<Database['prepare']>
   private readonly deleteOutputFiles: ReturnType<Database['prepare']>
@@ -206,10 +220,13 @@ export class OutputIndex {
     // graph stage 100 → 54 ms, the whole process 422 → 368 ms.
     const results = expected.map((e) => {
       try {
+        if (e.mode === LINK_MODE) return linkCurrent(path.join(projectDir, e.path), e)
         const s = statSync(path.join(projectDir, e.path))
+        // An empty output directory: current while a directory stands there.
+        if (e.path.endsWith('/')) return s.isDirectory()
         return (
           s.size === e.size &&
-          (s.mode & 0o777) === (e.mode & 0o777) &&
+          modeMatches(s.mode, e.mode) &&
           // MILLISECOND comparison (sub-ms tolerance for the float
           // round-trip through utimes). Save rows carry stat-ms and
           // restoreOutputs re-syncs restored files to the row value,
@@ -324,6 +341,7 @@ export class OutputIndex {
     const rows = this.rowsOf(hash)
     const stamps: Array<[string, number, number]> = []
     for (const e of rows) {
+      if (e.path.endsWith('/') || e.mode === LINK_MODE) continue
       const ws = e.path.startsWith(WORKSPACE_OUTPUT_PREFIX)
       const abs = ws
         ? path.join(workspaceRoot, e.path.slice(WORKSPACE_OUTPUT_PREFIX.length))
@@ -332,7 +350,7 @@ export class OutputIndex {
         const s = statSync(abs)
         if (
           s.size === e.size &&
-          (s.mode & 0o777) === (e.mode & 0o777) &&
+          modeMatches(s.mode, e.mode) &&
           Math.abs(s.mtimeMs - e.mtimeMs) < 1
         ) {
           stamps.push([e.path, s.ino, Math.floor(s.ctimeMs)])
@@ -415,10 +433,13 @@ export class OutputIndex {
     const results = rows.map((r) => {
       let st
       try {
-        st = lstatSync(path.join(projectDir, r.path))
+        // No throw for a missing dir: every restore after a clean asks
+        // about one, and an exception per hit cost more than the stat.
+        st = lstatSync(path.join(projectDir, r.path), { throwIfNoEntry: false })
       } catch {
         return r.mtimeMs === ABSENT_DIR_MTIME
       }
+      if (st === undefined) return r.mtimeMs === ABSENT_DIR_MTIME
       if (r.mtimeMs === ABSENT_DIR_MTIME) return false
       if (r.mtimeMs === FILE_PREFIX_MTIME) return st.isFile()
       return st.isDirectory() && Math.abs(st.mtimeMs - r.mtimeMs) < 1

package/src/cache/remote-lane.ts

@@ -10,8 +10,11 @@ import type { RemoteCacheLayer } from './layered-cache.js'
 /** One remote, resolved: its wire and what the run's policy and its `access` let it do. */
 export interface ResolvedRemote {
   readonly remote: RemoteCacheLayer
-  readonly read: boolean
-  readonly write: boolean
+  /** The plugin that supplied it, whose keychain its `open` reads; none for an injected layer. */
+  readonly plugin?: string
+  /** Cleared, with `write`, when the remote's `open` fails: off for the rest of the run. */
+  read: boolean
+  write: boolean
   /** Told of each failure this remote degrades to a miss; the default writes stderr. */
   readonly onError?: (err: Error) => void
 }
@@ -89,8 +92,7 @@ function batchOf(hashes: readonly string[]): { batch: string } {
 }
 
 export class RemoteLane {
-  readonly read: boolean
-  readonly write: boolean
+  private readonly resolved: ResolvedRemote
   private readonly remote: RemoteCacheLayer
   private readonly endpoint: string | undefined
   private readonly onError: ((err: Error) => void) | undefined
@@ -132,13 +134,20 @@ export class RemoteLane {
     resolved: ResolvedRemote,
     private readonly traffic: RemoteTraffic,
   ) {
+    this.resolved = resolved
     this.remote = resolved.remote
-    this.read = resolved.read
-    this.write = resolved.write
     this.onError = resolved.onError
     this.endpoint = printableEndpoint(resolved.remote.endpoint)
   }
 
+  get read(): boolean {
+    return this.resolved.read
+  }
+
+  get write(): boolean {
+    return this.resolved.write
+  }
+
   /**
    * Existence probe; a failure is a miss. A key a `hasMany` this run
    * answered for is not asked again: `--dry` batches its keys first.
@@ -248,6 +257,7 @@ export class RemoteLane {
     tally: { count: number; bytes: number; ms: number; failed: number },
   ): void {
     const key = this.trafficOf(hash)
+    const counted = this.traffic.aliases.get(hash) ?? hash
     key.uploading++
     this.traffic.inFlight++
     this.uploadQueue.push(async () => {
@@ -274,12 +284,17 @@ export class RemoteLane {
         // Nothing sent and nothing failed (the remote held it, or the run
         // stopped first): no traffic, so the footer counts no upload.
         if (key.uploading === 0 && !key.landed && key.failures.length === 0)
-          this.traffic.keys.delete(hash)
+          this.traffic.keys.delete(counted)
       }
     })
     this.pump()
   }
 
+  /** Settles when the run is stopped. */
+  get whenStopped(): Promise<void> {
+    return this.stopping
+  }
+
   /** Resolves once every queued and in-flight upload has settled, or the run was stopped. */
   async drain(): Promise<void> {
     // A probe no upload waited on still runs: settled before the run tears
@@ -292,7 +307,8 @@ export class RemoteLane {
   /**
    * The run was stopped (Ctrl-C, SIGTERM, an embedder's abort): queued
    * uploads never start and the drain stops waiting on the ones in flight,
-   * which a plugin cannot be asked to cancel. A slow remote held a stopped
+   * which a plugin cannot be asked to cancel. Reads in flight are given up
+   * the same way (`LayeredCache.pullFrom`). A slow remote held a stopped
    * run past the signal's exit bound, which then exited with no footer.
    */
   stop(): void {
@@ -343,10 +359,11 @@ export class RemoteLane {
   }
 
   private trafficOf(hash: string): RemoteKeyTraffic {
-    let key = this.traffic.keys.get(hash)
+    const counted = this.traffic.aliases.get(hash) ?? hash
+    let key = this.traffic.keys.get(counted)
     if (key === undefined) {
       key = { uploading: 0, landed: false, failures: [] }
-      this.traffic.keys.set(hash, key)
+      this.traffic.keys.set(counted, key)
     }
     return key
   }

package/src/cache/schema.ts

@@ -140,6 +140,14 @@ export function createTables(db: Database, store: 'main' | 'store' = 'main'): vo
       content_hash TEXT NOT NULL,
       seen_at      INTEGER NOT NULL
     );
+    -- v42: each task's last key by its fold up to the files and a token of
+    -- the files' git records (fold-memo.ts). A memo: the KEY is unchanged.
+    CREATE TABLE IF NOT EXISTS main.fold_memo (
+      task_id TEXT PRIMARY KEY,
+      probe   TEXT NOT NULL,
+      key     TEXT NOT NULL,
+      seen_at INTEGER NOT NULL
+    );
     -- The size of each index blob the enumeration checked against the
     -- worktree size git recorded (A-60). Fixed for its OID, so a warm
     -- run asks git for none; swept with file_hashes by seen_at, the
@@ -317,8 +325,10 @@ export function createTables(db: Database, store: 'main' | 'store' = 'main'): vo
  * the artifact is the record and the entries only its inventory, so a reset
  * drops the rows and keeps these, as it keeps the files. `artifacts_meta`
  * holds the table's own layout version (`'layout'`), the one thing that may
- * drop it. `at` is the last use a row-less sweep judges, as a file's mtime;
- * it sits before `bytes` so reading it never walks a blob's overflow pages.
+ * drop it. `at` is the last use a row-less sweep judges, as a file's mtime.
+ * A rowid table, not WITHOUT ROWID: there the blob sits in the key's b-tree,
+ * so every probe of a hash reads overflow pages; 10 000 lookups took 312 ms
+ * against 8.5 (a2, 2026-10-17).
  */
 export function createArtifactTables(db: Database, store: 'main' | 'store'): void {
   db.exec(artifactTables(store))
@@ -331,7 +341,7 @@ function artifactTables(store: 'main' | 'store'): string {
       hash  TEXT PRIMARY KEY,
       at    INTEGER NOT NULL,
       bytes BLOB NOT NULL
-    ) WITHOUT ROWID;
+    );
     CREATE TABLE IF NOT EXISTS ${store}.artifacts_meta (
       key   TEXT PRIMARY KEY,
       value TEXT NOT NULL

package/src/cache/scoped-cache.ts

@@ -61,7 +61,9 @@ export class ScopedCache implements CacheLayer {
   }
 
   private own(hash: string): string {
-    return scopedKey(this.scope, hash)
+    const key = scopedKey(this.scope, hash)
+    this.local?.traffic.aliases.set(key, hash)
+    return key
   }
 
   private keyOf(hash: string): string {

package/src/cache/umask.ts

@@ -0,0 +1,29 @@
+// The process umask, read when a restore starts: Bun reads it by setting 0
+// and putting it back in one synchronous call (project-loader.ts
+// `currentUmask`), so no spawn on this thread sees the 0, and a run
+// evaluates no config in a worker. Through globalThis: the playground's
+// shim has no umask.
+const proc = globalThis.process as { umask?: () => number } | undefined
+let umask = 0
+
+/** Read the umask again: a restore's modes follow the process's as it is now. */
+export function readUmask(): void {
+  if (typeof proc?.umask === 'function') umask = proc.umask()
+}
+readUmask()
+
+/**
+ * The permission bits a restore gives a stored `mode`: minus the umask, as
+ * tar gives a non-root user and Turbo does. A hit under `umask 077` gave
+ * back 0644 / 0755 where the build left 0600 / 0700, readable by every
+ * user on the machine (Growth's parity run, 2026-10-16).
+ */
+export function restoredMode(mode: number): number {
+  return mode & 0o777 & ~umask
+}
+
+/** A file on disk holds the stored `mode`: as saved, or as a restore here leaves it. */
+export function modeMatches(disk: number, stored: number): boolean {
+  const d = disk & 0o777
+  return d === (stored & 0o777) || d === restoredMode(stored)
+}

package/src/cli/docs.ts

@@ -1,12 +1,16 @@
 // `vx docs <query> [--limit N] [--format pretty|json]` — search vx's
-// reference offline, for an agent that cannot reach the site: each page is
+// reference as this version wrote it: packages/vx/docs at its git tag on
+// GitHub, read online (M, 2026-10-17: nothing is embedded). Each page is
 // cut at its headings, and the sections holding every query word print
 // whole, best first.
 
+import { VERSION } from '../version.js'
 import { flagHint, formatValue, refuse, refusedWord, seeHelp } from './help.js'
 
 const SITE = 'https://vznjs.github.io/vx/'
 const DEFAULT_LIMIT = 3
+const REPO = 'vznjs/vx'
+const DIR = 'packages/vx/docs'
 
 interface DocsArgs {
   terms: string[]
@@ -59,9 +63,55 @@ function anchor(heading: string): string {
     .replace(/ /g, '-')
 }
 
-/** A page's URL on the site; `features.md` is served as `all-features/`. */
+/** A page's URL on the site, as packages/vx-docs/scripts/import-docs.ts serves it. */
 function pageUrl(page: string): string {
-  return `${SITE}${page === 'features' ? 'all-features' : page}/`
+  const served: Record<string, string> = {
+    README: 'overview',
+    features: 'all-features',
+    'turbo-nx-support': 'compare/turbo-nx-support',
+  }
+  return `${SITE}${served[page] ?? page.toLowerCase()}/`
+}
+
+/** The git ref this vx's docs are at: its release tag; a source checkout (0.0.0) reads main. */
+export function docsRef(version: string = VERSION): string {
+  return version === '0.0.0' ? 'main' : `v${version}`
+}
+
+/**
+ * Every page of packages/vx/docs at `ref` (its own `.md` files, the
+ * maintainers' STATUS.md aside), page name → markdown. One listing, then
+ * the pages at once. Throws with what failed; a token in GITHUB_TOKEN or
+ * GH_TOKEN lifts GitHub's anonymous listing limit.
+ */
+export async function loadPages(
+  ref: string,
+  get: (url: string, init?: RequestInit) => Promise<Response> = fetch,
+  env: Record<string, string | undefined> = process.env,
+): Promise<Record<string, string>> {
+  const token = env['GITHUB_TOKEN'] ?? env['GH_TOKEN']
+  const listing = await get(
+    `https://api.github.com/repos/${REPO}/contents/${DIR}?ref=${encodeURIComponent(ref)}`,
+    {
+      headers: {
+        accept: 'application/vnd.github+json',
+        ...(token ? { authorization: `Bearer ${token}` } : {}),
+      },
+    },
+  )
+  if (!listing.ok) throw new Error(`GitHub answered ${listing.status} listing ${DIR} at ${ref}`)
+  const names = ((await listing.json()) as Array<{ name: string; type: string }>)
+    .filter((e) => e.type === 'file' && e.name.endsWith('.md') && e.name !== 'STATUS.md')
+    .map((e) => e.name)
+  const texts = await Promise.all(
+    names.map(async (name) => {
+      const url = `https://raw.githubusercontent.com/${REPO}/${ref}/${DIR}/${name}`
+      const r = await get(url)
+      if (!r.ok) throw new Error(`GitHub answered ${r.status} for ${url}`)
+      return r.text()
+    }),
+  )
+  return Object.fromEntries(names.map((n, i) => [n.slice(0, -3), texts[i]!]))
 }
 
 interface Section {
@@ -137,7 +187,10 @@ export function searchDocs(
   }))
 }
 
-export async function docsCmd(args: readonly string[]): Promise<number> {
+export async function docsCmd(
+  args: readonly string[],
+  load: (ref: string) => Promise<Record<string, string>> = loadPages,
+): Promise<number> {
   const parsed = parseDocsArgs(args)
   if (parsed.error) return refuse('docs', args, parsed.error, 'VX_E_USAGE')
   if (parsed.terms.length === 0) {
@@ -148,8 +201,19 @@ export async function docsCmd(args: readonly string[]): Promise<number> {
       'VX_E_USAGE',
     )
   }
-  const { PAGES } = await import('./docs-corpus.js')
-  const hits = searchDocs(PAGES, parsed.terms, parsed.limit)
+  const ref = docsRef()
+  let pages: Record<string, string>
+  try {
+    pages = await load(ref)
+  } catch (err) {
+    return refuse(
+      'docs',
+      args,
+      `cannot read the docs at ${ref} from GitHub (${err instanceof Error ? err.message : String(err)}); they are on the site, ${SITE}`,
+      'VX_E_NETWORK',
+    )
+  }
+  const hits = searchDocs(pages, parsed.terms, parsed.limit)
   const query = parsed.terms.join(' ')
   if (parsed.json) {
     process.stdout.write(`${JSON.stringify({ query, hits })}\n`)
@@ -157,7 +221,7 @@ export async function docsCmd(args: readonly string[]): Promise<number> {
   }
   if (hits.length === 0) {
     process.stdout.write(
-      `vx docs: no section of ${Object.keys(PAGES).join(', ')} holds every word of "${query}"; try fewer words, or ${SITE}llms.txt\n`,
+      `vx docs: no section of the docs at ${ref} holds every word of "${query}"; try fewer words, or ${SITE}llms.txt\n`,
     )
     return 0
   }

package/src/cli/help.ts

@@ -287,10 +287,10 @@ export function helpText(pluginCommands: readonly string[] = []): string {
     '                           or write it where the shell loads completions from.',
     '',
     'Docs:',
-    '  vx docs <query>      Search the reference offline (cli, schema, caching, execution,',
-    '                       patterns, security, features): the sections holding every',
-    '                       word of the query print whole, best first, with their URL;',
-    '                       an error code (vx docs VX_E_CYCLE) prints its fix alone.',
+    "  vx docs <query>      Search the reference at this version's tag on GitHub (online):",
+    '                       the sections holding every word of the query print whole,',
+    '                       best first, with their URL; an error code',
+    '                       (vx docs VX_E_CYCLE) prints its fix alone.',
     '      --limit N        How many sections (default 3).',
     '      --format json    {query, hits: [{page, heading, url, text}]}.',
     '',

package/src/cli/plan-format.ts

@@ -148,7 +148,10 @@ export interface PlanTaskJson {
 }
 
 /** `affectedBase`: the ref a bare `--affected` guessed (or was given), so a reader knows what the diff was against. */
-export function formatPlanJson(plan: RunPlan, affectedBase?: string): string {
+export function formatPlanJson(
+  plan: Pick<RunPlan, 'tasks' | 'predicted' | 'downloadDowngrades'>,
+  affectedBase?: string,
+): string {
   return (
     JSON.stringify(
       {

package/src/cli/run.ts

@@ -595,9 +595,16 @@ export async function runCmd(args: readonly string[]): Promise<number> {
   const scopeOut: { affectedBase?: string } = {}
   const resolved = await resolveRunOptions(parsed, cwd, tasks, 'run', scopeOut)
   if ('error' in resolved) return refuse('run', args, resolved.error, resolved.code ?? 'VX_E_USAGE')
+  // `--dry=json` prints a plan even when there is nothing to run: a script
+  // reading stdout broke exactly then (Growth, 2026-10-16).
+  const nothingToRun = (): 0 => {
+    if (parsed.dry === 'json')
+      process.stdout.write(formatPlanJson({ tasks: [] }, scopeOut.affectedBase))
+    return 0
+  }
   if ('nothingSelected' in resolved) {
     sayNotice('info', 'vx run', resolved.nothingSelected)
-    return 0
+    return nothingToRun()
   }
   const opts = resolved
   // The raw invocation, recorded on the `invocations` row so dashboards
@@ -628,11 +635,11 @@ export async function runCmd(args: readonly string[]): Promise<number> {
       // said no affected project declared a task one did (X-141).
       if (plan.noneAffected !== undefined) {
         sayLine('info', plan.noneAffected, 'vx run')
-        return 0
+        return nothingToRun()
       }
       if (opts.selectedByDiff === true) {
         sayNotice('info', 'vx run', `no affected project declares task(s): ${tasks.join(', ')}`)
-        return 0
+        return nothingToRun()
       }
       return refuse(
         'run',

package/src/cli/select.ts

@@ -36,6 +36,7 @@ import {
 } from '../util/index.js'
 import {
   claimedAffected,
+  claimedExtraFiles,
   fingerprintClaims,
   gitOfDiscovery,
   hasHook,
@@ -123,6 +124,7 @@ async function workspaceFingerprintClaims(
   return {
     files: new Set(claims.keys()),
     affected: (change) => claimedAffected(claims.get(change.file)!, change, ctx),
+    extraFiles: (file, bytes) => claimedExtraFiles(claims.get(file)!, file, bytes),
   }
 }
 

package/src/exec/runner.ts

@@ -50,6 +50,10 @@ export interface RunResult {
   /** `Bun.spawn` threw: no shell ran, so its 127 is vx's and says nothing
    *  about the command (A-41). */
   spawnFailed?: true
+  /** The shell exited while a process it started still held its
+   *  stdout/stderr past the drain bound (`POST_EXIT_CUT_LINE`): that process
+   *  may still write the task's outputs, so the result is not saved. */
+  leftRunning?: true
 }
 
 /**
@@ -1034,6 +1038,7 @@ export async function runCommand(opts: RunOptions): Promise<RunResult> {
     stderr,
     ...(proc.signalCode ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
+    ...(cut ? { leftRunning: true } : {}),
     ...resourceUsageToCpuRss(proc.resourceUsage(), rssFloorFor),
   }
 }