@vzn/vx 0.0.641 → 0.0.642

package/src/exec/sandbox-runtime.ts

@@ -1344,7 +1344,7 @@ async function wrapIn(
   if (process.platform === 'darwin') {
     const rules = [
       ...macProfileRules(args.config),
-      ...darwinWallRules(args.config, baselines.allowRead),
+      ...darwinGrantRules(args.config, baselines.allowRead, baselines.denyRead),
     ]
     try {
       if (rules.length > 0) wrapped = injectProfileRules(wrapped, rules)
@@ -2270,6 +2270,7 @@ async function runSandboxedOnce(
     violations,
     ...(proc.signalCode ? { signal: proc.signalCode } : {}),
     ...(timeout.timedOut() ? { timedOut: true } : {}),
+    ...(cut ? { leftRunning: true } : {}),
     // Linux: the task's CPU and peak never reach this wait. bwrap runs it
     // in a pid namespace (`--unshare-pid`), and what the namespace's
     // processes used is not folded into bwrap's usage: a 500 ms busy loop
@@ -2570,6 +2571,85 @@ export function wallsGlobsReach(grants: readonly string[], walls: readonly strin
   return walls.filter((w) => heads.some((h) => atOrUnder(w, h)))
 }
 
+/**
+ * macOS: the grant rules vx appends. The listings come first so a wall's
+ * deny, later, wins: SBPL is last-match-wins.
+ */
+export function darwinGrantRules(
+  c: Pick<ResolvedSandboxConfig, 'wallsReached' | 'allowRead' | 'allowWrite'>,
+  baseAllowRead: readonly string[],
+  anchors: readonly string[],
+): string[] {
+  return [...darwinAncestorRules(c, anchors), ...darwinWallRules(c, baseAllowRead)]
+}
+
+/**
+ * macOS: each directory above a grant may be listed, as on Linux. bwrap
+ * makes every directory above a mount, so a task granted
+ * `../vx-*\/package.json` could glob it from `..`; seatbelt matches paths
+ * and refused the listing (EPERM), so `@vzn/vx-docs#import` failed on
+ * every Mac (2026-10-17). Above the glob that is each literal directory
+ * strictly inside a deny anchor (outside one, all is readable already);
+ * a directory the glob itself names (`vx-a/`) is matched as a regex, and
+ * under a `**` any directory is. The rules grant directories only, never
+ * a file, and come before the wall denies, which still win.
+ *
+ * A listing shows every name in the directory, where Linux's scaffold
+ * shows only what it mounted: names, never a file's data. Not the anchor
+ * itself: Bun, shown the workspace root's `package.json` it
+ * may not read, failed with "Cannot read file" (EPERM).
+ */
+export function darwinAncestorRules(
+  c: Pick<ResolvedSandboxConfig, 'allowRead' | 'allowWrite'>,
+  anchors: readonly string[],
+): string[] {
+  const literals = new Set<string>()
+  const patterns = new Set<string>()
+  // Grants are canonical already (`resolveSandboxConfig`), and so is each
+  // directory above one: no realpath here, at every spawn.
+  const inside = (d: string): boolean => anchors.some((a) => d !== a && atOrUnder(d, a))
+  for (const g of [...c.allowRead, ...c.allowWrite]) {
+    const named = namedPath(g)
+    const head = g.slice(0, g.search(MOUNT_WILDCARDS))
+    const cut = head.lastIndexOf('/')
+    const top = named !== undefined ? path.dirname(named) : head.slice(0, cut) || '/'
+    for (let d = top; inside(d); d = path.dirname(d)) literals.add(d)
+    if (named !== undefined || g.includes('\\')) continue
+    let re = top === '/' ? '' : regexLiteral(top)
+    for (const part of g
+      .slice(cut + 1)
+      .split('/')
+      .slice(0, -1)) {
+      if (part === '**') {
+        patterns.add(`^${re}(/.*)?$`)
+        break
+      }
+      re += `/${part
+        .replace(/[.^$+{}()|]/g, '[$&]')
+        .replaceAll('*', '[^/]*')
+        .replaceAll('?', '[^/]')}`
+      patterns.add(`^${re}$`)
+    }
+  }
+  // A name seatbelt's quoted string cannot hold keeps today's refusal
+  // rather than failing the task (`sbplResolvedPath` would throw).
+  const spellable = (p: string): boolean => !UNSPELLABLE.test(p)
+  return [
+    ...[...literals].filter(spellable).map((d) => `(allow file-read-data (literal "${d}"))`),
+    ...[...patterns]
+      .filter(spellable)
+      .map((r) => `(allow file-read-data (require-all (vnode-type DIRECTORY) (regex #"${r}")))`),
+  ]
+}
+
+// eslint-disable-next-line no-control-regex -- the control range is the point
+const UNSPELLABLE = /["'\\\x00-\x1f\x7f]/
+
+/** A real path as a regex matching only itself: each special in a class of one. */
+function regexLiteral(p: string): string {
+  return p.replace(/[.^$+{}()|*?[\]]/g, (ch) => `[${ch}]`)
+}
+
 /**
  * macOS: the walls a glob grant reaches, denied at the profile's tail
  * (SBPL is last-match-wins). SRT re-emits a wall's deny after the allows

package/src/graph/priorities.ts

@@ -23,7 +23,20 @@ export function tieredReverseDepCount(
   restoreTier: ReadonlySet<string>,
 ): Map<string, number> {
   const exec = new Map<string, TaskNode>()
-  for (const [id, node] of nodes) if (!restoreTier.has(id)) exec.set(id, node)
+  let runsAny = false
+  for (const [id, node] of nodes) {
+    if (restoreTier.has(id)) continue
+    exec.set(id, node)
+    if (node.config.exec !== undefined) runsAny = true
+  }
+  // Nothing outside the restore tier runs a command (a warm run: restores
+  // and groups), so no order finishes any work sooner: everything ranks 0.
+  // The weights below were 10 ms of a 1,000-project warm run.
+  if (!runsAny) {
+    const zeros = new Map<string, number>()
+    for (const id of nodes.keys()) zeros.set(id, 0)
+    return zeros
+  }
   // An exec tier with no edge inside it (a warm run's groups) counts 0
   // everywhere: no closure to build.
   let linked = false

package/src/history/history.ts

@@ -263,56 +263,66 @@ export class LocalHistoryProvider implements HistoryProvider {
    * newest imported timing (`importTimings`), else the median on any
    * branch, else none. The timings are the shared store's `task_durations`, so every
    * worktree of the repo reads them and a new one forecasts on its first
-   * run. A point read per task on `(project, task, source, id)`: exact
-   * however old the rows, where the runs window holds only the newest
-   * invocations.
+   * run. One statement per tier, an index probe per task on `(project,
+   * task, source, id)` inside it: exact however old the rows, where the
+   * runs window holds only the newest invocations.
    */
   private forecasts(wanted: ReadonlySet<string>): Map<string, number> {
     const out = new Map<string, number>()
     this.lackedBranchHistory = false
     if (wanted.size === 0) return out
-    // Tiers, first answer wins.
-    type Tier = (project: string, task: string) => Array<{ ms: number }>
+    // Tiers, first answer wins: a WHERE over `task_durations`, its params,
+    // and how many of the newest rows it reads.
+    type Tier = { where: string; params: string[]; limit: number }
     const tiers: Tier[] = []
-    const newest = (where: string) =>
-      this.db.query(
-        `SELECT duration_ms AS ms FROM task_durations WHERE project = ? AND task = ? AND ${where}
-         ORDER BY id DESC LIMIT ${FORECAST_RUNS}`,
-      )
     if (this.branch !== undefined) {
-      const source = branchSource(this.branch)
-      const q = newest('source = ?')
-      tiers.push((p, t) => q.all(p, t, source) as Array<{ ms: number }>)
+      tiers.push({ where: 'source = ?', params: [branchSource(this.branch)], limit: FORECAST_RUNS })
     }
     // One probe on the partial index first: a store with no import costs
-    // no query per task.
+    // no tier.
     if (
       this.db.query(`SELECT 1 FROM task_durations WHERE source = 'remote' LIMIT 1`).get() !== null
     ) {
-      const remote = this.db.query(
-        `SELECT duration_ms AS ms FROM task_durations WHERE project = ? AND task = ? AND source = 'remote'
-         ORDER BY id DESC LIMIT 1`,
-      )
-      tiers.push((p, t) => remote.all(p, t) as Array<{ ms: number }>)
+      tiers.push({ where: `source = 'remote'`, params: [], limit: 1 })
     }
-    const any = newest(`source LIKE 'branch:%'`)
-    tiers.push((p, t) => any.all(p, t) as Array<{ ms: number }>)
+    tiers.push({ where: `source LIKE 'branch:%'`, params: [], limit: FORECAST_RUNS })
     const own = this.branch !== undefined ? tiers[0] : tiers.at(-1)
-    let lacked = false
-    for (const id of wanted) {
-      const [project, task] = splitTaskId(id)
-      let answered: Tier | undefined
-      for (const tier of tiers) {
-        const rows = tier(project, task)
-        if (rows.length === 0) continue
-        const durations = rows.map((r) => r.ms).sort((x, y) => x - y)
+    let pending = [...wanted]
+    let ownAnswered = 0
+    for (const tier of tiers) {
+      if (pending.length === 0) break
+      // One statement per tier over every task it is asked for: an index
+      // probe per task inside SQLite, where a query per task from here was
+      // 31-40 ms of 2,000 tasks against 5-8.
+      const rows = this.db
+        .query(
+          `SELECT j.key AS i, (SELECT group_concat(ms) FROM (
+             SELECT duration_ms AS ms FROM task_durations
+             WHERE project = j.value ->> 0 AND task = j.value ->> 1 AND ${tier.where}
+             ORDER BY id DESC LIMIT ${tier.limit})) AS ds
+           FROM json_each(?) AS j`,
+        )
+        .all(...tier.params, JSON.stringify(pending.map(splitTaskId))) as {
+        i: number
+        ds: string | null
+      }[]
+      const left: string[] = []
+      for (const r of rows) {
+        const id = pending[r.i]!
+        if (r.ds === null) {
+          left.push(id)
+          continue
+        }
+        const durations = r.ds
+          .split(',')
+          .map(Number)
+          .sort((x, y) => x - y)
         out.set(id, pickPercentile(durations, 0.5))
-        answered = tier
-        break
+        if (tier === own) ownAnswered++
       }
-      if (answered !== own) lacked = true
+      pending = left
     }
-    this.lackedBranchHistory = lacked
+    this.lackedBranchHistory = ownAnswered < wanted.size
     return out
   }
 

package/src/index.ts

@@ -83,9 +83,19 @@ export type {
   CacheLayer,
   PluginCache,
   RemoteCacheLayer,
+  RemoteOpenContext,
   RunRecord,
   InvocationRecord,
 } from './cache/index.js'
+// A plugin's keychain (`ctx.secret` on `setup` and a remote's `open`), and
+// the guard that tells a missing secret from a fault.
+export { isSecretUnavailable } from './util/index.js'
+export type {
+  PluginSecrets,
+  SecretRequest,
+  SecretUnavailable,
+  SecretUnavailableReason,
+} from './util/index.js'
 
 // Workspace discovery + the project/config catalog surface — an
 // out-of-process service/CLI needs these. `loadProjectConfig` is the RAW

package/src/orchestrator/deferred-outputs.ts

@@ -15,7 +15,7 @@
 import {
   cleanOutputs,
   committedFiles,
-  resolveOutputs,
+  resolveOutputTree,
   type CacheLayer,
   type GitFilesCache,
 } from '../cache/index.js'
@@ -144,7 +144,7 @@ export class DeferredOutputs {
         `could not fetch deferred outputs of ${taskId}: ${msg} — re-run it with --force, or use --cache-download=all`,
       )
     }
-    const outputFiles = await resolveOutputs(cleanArgs)
+    const { files: outputFiles, emptyDirs } = await resolveOutputTree(cleanArgs)
     this.args.gitFilesCache?.markOutputsChanged(
       producer.projectDir,
       outputFiles.map((f) => f.slice(producer.projectDir.length + 1)),
@@ -157,6 +157,7 @@ export class DeferredOutputs {
         hash: entry.hash,
         projectDir: producer.projectDir,
         outputFiles,
+        ...(emptyDirs.length > 0 ? { outputDirs: emptyDirs } : {}),
         entry: entry.entry,
       })
     }

package/src/orchestrator/execute-task.ts

@@ -61,7 +61,6 @@ import {
   type Placeholder,
   reachedWithheld,
   sandboxRequestFor,
-  sandboxReadable,
   sweepPlaceholders,
   undeclaredWriteReach,
   untouchedPlaceholderLine,
@@ -233,7 +232,7 @@ export interface ExecuteArgs {
    */
   outputDirSnapshots?: OutputDirSnapshot[]
   /** The run's save lane: a miss's cache save runs off the execution slot (save-lane.ts). */
-  deferSave?: (save: () => Promise<void>) => Promise<void>
+  deferSave?: (save: () => Promise<void>) => Promise<boolean>
   /**
    * Where a deferred save's `landed` promise is parked by task id, for the
    * in-flight join (admission.ts): a duplicate of this task in another run
@@ -1278,6 +1277,7 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
   } else if (
     effectiveExitCode === 0 &&
     willSave &&
+    nothingLeftRunning() &&
     (await keyStillTrue()) &&
     (own = await ownOutputs()) !== undefined
   ) {
@@ -1302,19 +1302,11 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
       deferSave: args.deferSave,
       // A sink listens: say what the save cost.
       measure: args.explainMiss !== undefined,
-      ...(userSandbox
-        ? {
-            readable: sandboxReadable(
-              node,
-              cfg.exec!.sandbox!,
-              args.workspaceRoot,
-              args.nestedProjectDirs,
-            ),
-          }
-        : {}),
     })
-    args.deferredSaves?.set(node.id, landed)
-    saved = true
+    // A run that settles the outcome on `landed` learns there whether the
+    // entry is in; without one, the save is taken as done.
+    if (args.deferredSaves !== undefined) args.deferredSaves.set(node.id, landed)
+    else saved = true
   } else if (cfgCacheable && !remoteOnly && !deferralRequested && args.noDependants !== true) {
     // Ran here and saves nothing — failed, a read-only policy, a tainted
     // upstream, a key that no longer held — yet it wrote what a save would
@@ -1362,6 +1354,20 @@ async function executeCachedTask(args: ExecuteArgs): Promise<TaskOutcome> {
     return mine
   }
 
+  /**
+   * A process the shell left behind still held its output when the drain
+   * bound cut it, so it may still write outputs: a save now would file a
+   * tree the run does not leave, and a hit elsewhere would replay it.
+   */
+  function nothingLeftRunning(): boolean {
+    if (result.leftRunning !== true) return true
+    warnOf(log)(
+      `[vx] ${node.id}: a process it left running may still write its outputs — ` +
+        `the result stands, but is not saved; wait for it in the command (\`wait\`)`,
+    )
+    return false
+  }
+
   /**
    * The input that no longer holds what the key folded, or one the key did
    * not fold that is there now: `null` when the key re-derived just before

package/src/orchestrator/hit-restore.ts

@@ -8,6 +8,7 @@
 // which bytes a green run replays. Moved out of execute-task.ts
 // 2026-09-10 as pure code motion, the mirror of miss-save.ts.
 
+import path from 'node:path'
 import type { CacheConfig } from '../config.js'
 import {
   type CacheEntry,
@@ -166,7 +167,7 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
           actual: readonly string[],
           exp: ReadonlyArray<{ path: string }>,
         ): boolean => {
-          const expSet = new Set(exp.map((e) => e.path))
+          const expSet = new Set(exp.map((e) => e.path).filter((p) => !p.endsWith('/')))
           return actual.length === expSet.size && actual.every((r) => expSet.has(r))
         }
         // A stray a dependant's glob could have added is not a stray; a path
@@ -185,7 +186,7 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
           exp: ReadonlyArray<{ path: string }>,
         ): boolean => {
           const have = new Set(actual)
-          return exp.every((e) => have.has(e.path))
+          return exp.every((e) => e.path.endsWith('/') || have.has(e.path))
         }
         treeMatches = additive
           ? rowsPresent(actualRels, projExpected) && rowsPresent(actualWsRels, wsExpected)
@@ -289,6 +290,13 @@ export async function restoreHit(restore: RestoreHitArgs): Promise<TaskOutcome>
         rels: staleRels,
         outputs,
         committed: cleanArgs.committed,
+        // A stale file in an output directory the entry holds empty takes
+        // only itself: the directory stays, as the miss left it.
+        keep: new Set(
+          heldRels
+            .filter((r) => r.endsWith('/'))
+            .map((r) => path.join(node.projectDir, r.slice(0, -1))),
+        ),
       })
     }
     if (staleWsRels.length > 0) {

package/src/orchestrator/index.ts

@@ -77,6 +77,7 @@ export {
   applyProjectHooks,
   applyScheduleHooks,
   claimedAffected,
+  claimedExtraFiles,
   fingerprintClaims,
   hasHook,
   REMOTE_CACHE_METHODS,

package/src/orchestrator/lockfile-claim.ts

@@ -39,7 +39,9 @@ export interface LockfileClaimOptions {
    * the lockfile does not pin (bun.lock's `patchedDependencies` names a patch
    * file and records no hash of it). Their content hashes ('' when absent)
    * reach `digest` as `files` and join the memo's identity, so an edited
-   * patch moves the key (item 1014). Called only when the memo misses.
+   * patch moves the key (item 1014). A directory (a `file:` dependency the
+   * install copies) hashes every file under it but `node_modules` and
+   * `.git`. Called only when the memo misses.
    */
   readonly extraFiles?: (text: string) => readonly string[]
   /** Folded into the memo's identity: bump when `digest` folds differently. */
@@ -109,13 +111,33 @@ interface Memo {
 /** A root-relative extra file's content hash, '' when absent; a path leaving the root is never read. */
 async function hashExtra(workspaceRoot: string, rel: string): Promise<string> {
   if (path.isAbsolute(rel) || rel.split(/[\\/]/).includes('..')) return 'outside-root'
+  const abs = path.join(workspaceRoot, rel)
   try {
-    return xxh3hex(await Bun.file(path.join(workspaceRoot, rel)).bytes())
-  } catch {
+    return xxh3hex(await Bun.file(abs).bytes())
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === 'EISDIR') return hashDir(abs)
     return ''
   }
 }
 
+/**
+ * Every file under `dir` but its `node_modules` and `.git`, as `rel\0hash`
+ * lines in sorted order. Links are followed: a linked file is what a task
+ * reads, and the scan skipped it, so an edit to its target moved no key.
+ */
+async function hashDir(dir: string): Promise<string> {
+  const rels: string[] = []
+  const scan = { cwd: dir, dot: true, onlyFiles: true, followSymlinks: true }
+  for await (const rel of new Bun.Glob('**').scan(scan)) {
+    if (!rel.split('/').some((s) => s === 'node_modules' || s === '.git')) rels.push(rel)
+  }
+  rels.sort()
+  const lines = await Promise.all(
+    rels.map(async (rel) => `${rel}\0${xxh3hex(await Bun.file(path.join(dir, rel)).bytes())}`),
+  )
+  return `dir\0${xxh3hex(lines.join('\n'))}`
+}
+
 /**
  * A file's identity for the in-process gate, as `Cache.hashFile`'s memo
  * keys one: size and mtime alone kept the digests of a lockfile or patch
@@ -126,9 +148,16 @@ function identityOf(st: { size: number; mtimeMs: number; ctimeMs: number; ino: n
   return `${st.size}:${st.mtimeMs}:${st.ctimeMs}:${st.ino}`
 }
 
+// A directory's own stat moves only when an entry is added or removed, not
+// when a file in it is edited: its identity is its content hash.
 async function statsOf(workspaceRoot: string, rels: readonly string[]): Promise<string[]> {
   return Promise.all(
-    rels.map((rel) => stat(path.join(workspaceRoot, rel)).then(identityOf, () => 'gone')),
+    rels.map((rel) =>
+      stat(path.join(workspaceRoot, rel)).then(
+        (st) => (st.isDirectory() ? hashExtra(workspaceRoot, rel) : identityOf(st)),
+        () => 'gone',
+      ),
+    ),
   )
 }
 
@@ -262,15 +291,29 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
         // lockfile is broken" and "the base commit's is" — a migration
         // commit hits the second, and the bare parser message named
         // neither (2026-09-20).
-        const sideOf = (bytes: Uint8Array, side: string): ReadonlyMap<string, string> => {
+        // A changed extra file is folded by its content on each side; one
+        // left out is the same on both, so it moves no digest either way.
+        const extrasOf = (pick: 'before' | 'after'): Map<string, string> => {
+          const out = new Map<string, string>()
+          for (const [rel, sides] of change.extras ?? []) {
+            const bytes = sides[pick]
+            out.set(rel, bytes === null ? '' : xxh3hex(bytes))
+          }
+          return out
+        }
+        const sideOf = (
+          bytes: Uint8Array,
+          pick: 'before' | 'after',
+          side: string,
+        ): ReadonlyMap<string, string> => {
           try {
-            return digest(decode(bytes), new Map())
+            return digest(decode(bytes), extrasOf(pick))
           } catch (err) {
             throw new Error(`${err instanceof Error ? err.message : String(err)} (${side})`)
           }
         }
-        const before = sideOf(change.before, `as of the base ref`)
-        const after = sideOf(change.after, `in the working tree`)
+        const before = sideOf(change.before, 'before', `as of the base ref`)
+        const after = sideOf(change.after, 'after', `in the working tree`)
         const names: string[] = []
         for (const p of ctx.projects) {
           const importer = importerOf(ctx.workspaceRoot, p.dir)
@@ -278,6 +321,9 @@ export function lockfileClaim(options: LockfileClaimOptions): LockfileClaimHooks
         }
         return names
       },
+      ...(options.extraFiles !== undefined
+        ? { extraFiles: (_file: string, bytes: Uint8Array) => options.extraFiles!(decode(bytes)) }
+        : {}),
     },
     async key(task, ctx) {
       const digests = await loadOnce(ctx)

package/src/orchestrator/miss-save.ts

@@ -12,6 +12,7 @@ import path from 'node:path'
 import {
   type CacheLayer,
   type GitFilesCache,
+  resolveOutputTree,
   resolveOutputs,
   resolveWorkspaceOutputs,
   WORKSPACE_OUTPUT_PREFIX,
@@ -51,7 +52,9 @@ export function entryHolds(
 ): (files: readonly string[], rows: ReadonlyArray<{ path: string }>) => boolean {
   return (files, rows) => {
     const expected = new Set(
-      rows.map((r) => r.path).filter((p) => !p.startsWith(WORKSPACE_OUTPUT_PREFIX)),
+      rows
+        .map((r) => r.path)
+        .filter((p) => !p.startsWith(WORKSPACE_OUTPUT_PREFIX) && !p.endsWith('/')),
     )
     const seen = new Set(files)
     if ((node.addsToOutputsOf?.length ?? 0) > 0) return [...expected].every((p) => seen.has(p))
@@ -111,8 +114,6 @@ export interface SaveMissArgs {
   ownOutputFiles?: string[] | undefined
   /** `ownOutputFiles` for `cache.outputs.workspaceFiles` (A-43). */
   ownWsOutputFiles?: string[] | undefined
-  /** A sandboxed task's reach: a symlinked output it could not read is refused (`sandboxReadable`). */
-  readable?: ((real: string) => boolean) | undefined
   /** The Tier-3 input fingerprint rows captured by the pre-exec describe. */
   captured: readonly TaskInputComponent[]
   command: string
@@ -129,7 +130,7 @@ export interface SaveMissArgs {
    * (a same-project downstream task reads both), and the pack + write +
    * index go to the run's save lane (save-lane.ts).
    */
-  deferSave?: ((save: () => Promise<void>) => Promise<void>) | undefined
+  deferSave?: ((save: () => Promise<void>) => Promise<boolean>) | undefined
   /** Time the save and size its artifact, for a telemetry sink: one stat. */
   measure?: boolean | undefined
 }
@@ -138,6 +139,8 @@ export interface SaveMissArgs {
 export interface SaveFacts {
   saveMs?: number
   artifactBytes?: number
+  /** The entry landed: the outcome's `saved`, set only once it has. */
+  saved?: true
 }
 
 /**
@@ -147,13 +150,16 @@ export interface SaveFacts {
 export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveFacts> }> {
   const { node, cache, log } = a
   const endResolve = span('miss: resolve outputs')
-  const outputFiles =
-    a.ownOutputFiles ??
-    (await resolveOutputs({
-      projectDir: node.projectDir,
-      outputs: a.outputs,
-      nestedProjectDirs: a.nestedProjectDirs,
-    }))
+  // An additive task owns only the files it wrote (item 588), no directory.
+  const tree =
+    a.ownOutputFiles !== undefined
+      ? { files: a.ownOutputFiles, emptyDirs: [] }
+      : await resolveOutputTree({
+          projectDir: node.projectDir,
+          outputs: a.outputs,
+          nestedProjectDirs: a.nestedProjectDirs,
+        })
+  const outputFiles = tree.files
   const wsOutputFiles =
     a.ownWsOutputFiles ??
     (await resolveWorkspaceOutputs({
@@ -204,11 +210,11 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
       hash: a.hash,
       projectDir: node.projectDir,
       outputFiles,
-      ...(wsOutputFiles.length > 0
-        ? { workspaceOutputFiles: wsOutputFiles, workspaceRoot: a.workspaceRoot }
-        : {}),
+      ...(tree.emptyDirs.length > 0 ? { outputDirs: tree.emptyDirs } : {}),
+      // The root an output symlink's target must stay inside, outputs.workspaceFiles or not.
+      workspaceRoot: a.workspaceRoot,
+      ...(wsOutputFiles.length > 0 ? { workspaceOutputFiles: wsOutputFiles } : {}),
       inputComponents: a.captured.map((c) => ({ entryHash: a.hash, ...c })),
-      readable: a.readable,
       // No `exitCode`: the save only runs under `effectiveExitCode === 0`, and
       // the contract no longer accepts one — so the invariant is enforced by
       // the type rather than by every call site remembering the gate.
@@ -258,9 +264,13 @@ export async function saveMiss(a: SaveMissArgs): Promise<{ landed: Promise<SaveF
   // Off the slot when the run keeps a lane (the save lane bounds and
   // drains it); in the slot otherwise — an embedder without a lane gets
   // the entry before the outcome.
-  if (a.deferSave !== undefined) return { landed: a.deferSave(save).then(() => facts) }
+  if (a.deferSave !== undefined) {
+    return {
+      landed: a.deferSave(save).then((stored) => (stored ? { ...facts, saved: true } : facts)),
+    }
+  }
   await save()
-  return { landed: Promise.resolve(facts) }
+  return { landed: Promise.resolve({ ...facts, saved: true }) }
 }
 
 /** What `markUnsaved` reads of a miss: where its declared outputs are. */

package/src/orchestrator/output-host.ts

@@ -7,7 +7,15 @@ import type { Logger } from '../report/index.js'
 import type { OutputContext, VxPlugin } from './plugin.js'
 
 const REQUIRED = ['status', 'taskStdout', 'taskStderr', 'taskComplete'] as const
-const OPTIONAL = ['runStart', 'taskStart', 'runEnd', 'stepStart', 'stepEnd', 'runDone'] as const
+const OPTIONAL = [
+  'runStart',
+  'taskStart',
+  'runEnd',
+  'stepStart',
+  'stepEnd',
+  'runStop',
+  'runDone',
+] as const
 
 /** Reject anything that is not Logger-shaped, naming what is missing. */
 function checkLogger(value: unknown): Logger {

package/src/orchestrator/plan.ts

@@ -146,6 +146,10 @@ export async function plan(args: PlanArgs): Promise<RunPlan> {
   const outcomes = await runGraph({
     nodes: args.nodes,
     concurrency: 1,
+    // A plan's keys and probes do not depend on the order it walks in, so
+    // it ranks nothing: the default ranking's closure over every task was
+    // ~30 ms of a 1,000-project `--dry`.
+    strategy: 'ready-order',
     execute: async (node, live) => {
       const upstream = keyUpstream(node, live)
       const hashArgs = {